Denial of Service Vulnerability in Apache Commons Compress
CVE-2018-11771

5.5MEDIUM

Key Information:

Vendor
Apache
Status
Apache Commons Compress
Vendor
CVE Published:
16 August 2018

Summary

A vulnerability in Apache Commons Compress versions 1.7 to 1.17 can lead to a denial of service when handling specially crafted ZIP archives. This occurs due to improper EOF detection within the ZipArchiveInputStream's read method, potentially resulting in an infinite stream when used alongside java.io.InputStreamReader. Services utilizing this ZIP handling package may be adversely affected, making it crucial for users to update to the latest version for mitigation.

Affected Version(s)

Apache Commons Compress 1.7 to 1.17

References

http://www.securityfocus.com/bid/105139
vdb-entryx_refsource_BID
https://lists.apache.org/thread.html/b8da751fc0ca949534cd...
mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1041503
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.