PT-2019-5261 · Apache+1 · Apache Commons Compress+1

Published 2019-08-29 · Updated 2024-07-16 · CVE-2019-12402

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Commons Compress versions 1.15 through 1.18 Confluence Data Center versions from 7.19.23 to 8.9.3 Confluence Data Center versions from 8.5.10 to 8.5.11 Confluence Server versions from 7.19.23 to 7.19.24 Confluence Server versions from 8.5.10 to 8.5.11

Description The file name encoding algorithm used in Apache Commons Compress can get into an infinite loop when faced with specially crafted inputs, leading to a denial of service attack. An unauthenticated attacker can expose assets in the environment susceptible to exploitation with no impact to confidentiality, no impact to integrity, and high impact to availability, requiring no user interaction.

Recommendations For Apache Commons Compress versions 1.15 through 1.18, consider upgrading to a version outside of this range to mitigate the risk. For Confluence Data Center versions from 7.19.23 to 7.19.24, upgrade to version 8.9.4, 8.5.12 LTS, or 7.19.25 LTS. For Confluence Data Center versions from 8.5.10 to 8.5.11, upgrade to version 8.9.4 or 8.5.12 LTS. For Confluence Data Center versions from 8.9.2 to 8.9.3, upgrade to version 8.9.4. For Confluence Server versions from 7.19.23 to 7.19.24, upgrade to version 8.5.12 LTS or 7.19.25 LTS. For Confluence Server versions from 8.5.10 to 8.5.11, upgrade to version 8.5.12 LTS.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-399

CWE-835

Related Identifiers

BDU:2020-02116

CVE-2019-12402

GHSA-53X6-4X5P-RRVV

MGASA-2020-0001

OPENSUSE-SU-2024:10618-1

Affected Products

Apache Commons Compress

Confluence

References · 77

• 🔥 https://github.com/jensdietrich/xshady-release/tree/main/CVE-2019-12402 · Exploit
• https://osv.dev/vulnerability/GHSA-53x6-4x5p-rrvv · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-12402 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-12402 · Security Note
• https://bdu.fstec.ru/vul/2020-02116 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12402 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12402 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10618-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12402 · Security Note
• https://advisories.mageia.org/MGASA-2020-0001.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12402 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL · Vendor Advisory