Denial of Service Vulnerability in Apache Commons Compress
CVE-2018-11771

5.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Commons Compress
Vendor
CVE Published:
16 August 2018

What is CVE-2018-11771?

A vulnerability in Apache Commons Compress versions 1.7 to 1.17 can lead to a denial of service when handling specially crafted ZIP archives. This occurs due to improper EOF detection within the ZipArchiveInputStream's read method, potentially resulting in an infinite stream when used alongside java.io.InputStreamReader. Services utilizing this ZIP handling package may be adversely affected, making it crucial for users to update to the latest version for mitigation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Commons Compress 1.7 to 1.17

References

http://www.securityfocus.com/bid/105139
vdb-entryx_refsource_BID
https://lists.apache.org/thread.html/b8da751fc0ca949534cd...
mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1041503
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.