Bug 1557542 (CVE-2018-1324)

Summary: CVE-2018-1324 apache-commons-compress: Infinite loop via extra field parser in ZipFile and ZipArchiveInputStream classes
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aileenc, alazarot, anstephe, apevec, avibelli, bcourt, bgeorges, bkearney, bmcclain, chazlett, chrisw, cmoulliard, dblechte, dffrench, drieden, drusso, eedri, etirelli, gvarsami, hhorak, ibek, java-maint, java-sig-commits, jbalunas, jcoleman, jjoyce, jmadigan, jmatthew, jolee, jorton, jpallich, jschatte, jschluet, jshepherd, jstastny, kconner, krathod, kverlaen, ldimaggi, lgriffin, lhh, lpeer, lthon, markmc, mburns, mgoldboi, michal.skrivanek, mizdebsk, mkolesni, mmccune, mszynkie, ngough, nwallace, ohadlevy, pgallagh, pwright, rbryant, rchan, rrajasek, rruss, rsynek, rwagner, rzhang, sandro, sbonazzo, sclewis, sdaley, sherold, sisharma, slinaber, SpikeFedora, tcunning, tdecacqu, tkirby, trepel, tsanders, ykaul
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: apache-commons-compress 1.16 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1557543, 1558341, 1558342, 1563526, 1563527    
Bug Blocks: 1557544    

Description Pedro Sampaio 2018-03-16 20:25:18 UTC
A flaw was found in Apache Commons Compress versions 1.11 to 1.15. A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

Upstream patch:

https://git-wip-us.apache.org/repos/asf?p=commons-compress.git;a=blobdiff;f=src/main/java/org/apache/commons/compress/archivers/zip/X0017_StrongEncryptionHeader.java;h=acc3b22346b49845e85b5ef27a5814b69e834139;hp=0feb9c98cc622cde1defa3bbd268ef82b4ae5c18;hb=2a2f1dc48e22a34ddb72321a4db211da91aa933b;hpb=dcb0486fb4cb2b6592c04d6ec2edbd3f690df5f2

Upstream issue:

https://issues.apache.org/jira/browse/COMPRESS-432

Comment 1 Pedro Sampaio 2018-03-16 20:25:49 UTC
Created apache-commons-compress tracking bugs for this issue:

Affects: fedora-all [bug 1557543]

Comment 2 Pedro Sampaio 2018-03-16 20:26:41 UTC
External References:

https://commons.apache.org/proper/commons-compress/security-reports.html

Comment 3 Kurt Seifried 2018-03-19 16:04:37 UTC
Statement:

This issue affects the versions of lucene4 as shipped with Red Hat Enterprise Satellite 6.0 and 6.1. Red Hat Satellite 6.2 and later do not include the lucene4 component and are not affected.

Comment 5 Fedora Update System 2018-03-27 19:27:57 UTC
apache-commons-compress-1.13-3.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2018-03-27 20:03:51 UTC
apache-commons-compress-1.14-3.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Jason Shepherd 2018-06-12 04:13:14 UTC
RHMAP has a dependency on commons-compress because it's required by log4j-core. Log4j-core only uses commons-compress for compression of log files, and doesn't provide any decompression functionality. Therefore log4j-core and RHMAP are not affected by this flaw.