Bug 1557542 (CVE-2018-1324) - CVE-2018-1324 apache-commons-compress: Infinite loop via extra field parser in ZipFile and ZipArchiveInputStream classes
Summary: CVE-2018-1324 apache-commons-compress: Infinite loop via extra field parser ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1324
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1557543 1558341 1558342 1563526 1563527
Blocks: 1557544
TreeView+ depends on / blocked
 
Reported: 2018-03-16 20:25 UTC by Pedro Sampaio
Modified: 2021-10-21 19:57 UTC (History)
76 users (show)

Fixed In Version: apache-commons-compress 1.16
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 19:57:57 UTC
Embargoed:


Attachments (Terms of Use)

Description Pedro Sampaio 2018-03-16 20:25:18 UTC
A flaw was found in Apache Commons Compress versions 1.11 to 1.15. A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

Upstream patch:

https://git-wip-us.apache.org/repos/asf?p=commons-compress.git;a=blobdiff;f=src/main/java/org/apache/commons/compress/archivers/zip/X0017_StrongEncryptionHeader.java;h=acc3b22346b49845e85b5ef27a5814b69e834139;hp=0feb9c98cc622cde1defa3bbd268ef82b4ae5c18;hb=2a2f1dc48e22a34ddb72321a4db211da91aa933b;hpb=dcb0486fb4cb2b6592c04d6ec2edbd3f690df5f2

Upstream issue:

https://issues.apache.org/jira/browse/COMPRESS-432

Comment 1 Pedro Sampaio 2018-03-16 20:25:49 UTC
Created apache-commons-compress tracking bugs for this issue:

Affects: fedora-all [bug 1557543]

Comment 2 Pedro Sampaio 2018-03-16 20:26:41 UTC
External References:

https://commons.apache.org/proper/commons-compress/security-reports.html

Comment 3 Kurt Seifried 2018-03-19 16:04:37 UTC
Statement:

This issue affects the versions of lucene4 as shipped with Red Hat Enterprise Satellite 6.0 and 6.1. Red Hat Satellite 6.2 and later do not include the lucene4 component and are not affected.

Comment 5 Fedora Update System 2018-03-27 19:27:57 UTC
apache-commons-compress-1.13-3.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2018-03-27 20:03:51 UTC
apache-commons-compress-1.14-3.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Jason Shepherd 2018-06-12 04:13:14 UTC
RHMAP has a dependency on commons-compress because it's required by log4j-core. Log4j-core only uses commons-compress for compression of log files, and doesn't provide any decompression functionality. Therefore log4j-core and RHMAP are not affected by this flaw.


Note You need to log in before you can comment on or make changes to this bug.