oss-sec mailing list archives
[CVE-2018-1324] Apache Commons Compress denial of service vulnerability
From: Stefan Bodewig <bodewig () apache org>
Date: Fri, 16 Mar 2018 09:37:14 +0100
CVE-2018-1324: Apache Commons Compress denial of service vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Commons Compress 1.11 to 1.15 Description: A specially crafted ZIP archive can be used to cause an infinite loop inside of Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes. This can be used to mount a denial of service attack against services that use Compress' zip package. Mitigation: Commons Compress users should upgrade to 1.16 or later Credit: This issue was discovered by Luis Filipe Nassif.
Current thread:
- [CVE-2018-1324] Apache Commons Compress denial of service vulnerability Stefan Bodewig (Mar 16)