You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by Stefan Bodewig <bo...@apache.org> on 2018/03/16 08:37:14 UTC
[CVE-2018-1324] Apache Commons Compress denial of service vulnerability
CVE-2018-1324: Apache Commons Compress denial of service vulnerability
Severity: Low
Vendor:
The Apache Software Foundation
Versions Affected:
Apache Commons Compress 1.11 to 1.15
Description:
A specially crafted ZIP archive can be used to cause an infinite loop
inside of Compress' extra field parser used by the ZipFile and
ZipArchiveInputStream classes. This can be used to mount a denial of
service attack against services that use Compress' zip package.
Mitigation:
Commons Compress users should upgrade to 1.16 or later
Credit:
This issue was discovered by Luis Filipe Nassif.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org