Apache Commons Compress versions 1.7 to 1.17 are vulnerable to a denial of service attack via crafted ZIP archive. When reading a specially crafted ZIP archive, the read method of ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package. External Reference: https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330@%3Cannounce.apache.org%3E
Created apache-commons-compress tracking bugs for this issue: Affects: fedora-all [bug 1618574]
Upstream ticket: https://issues.apache.org/jira/browse/COMPRESS-463 Upstream patch: https://github.com/apache/commons-compress/commit/a41ce689 Prior patches introducing tests: https://github.com/apache/commons-compress/commit/0fe6ae31 https://github.com/apache/commons-compress/commit/64ed6dde
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Fuse Service Works 6 * Red Hat JBoss Fuse 6 * Red Hat JBoss Data Virtualization & Services 6 * Red Hat JBoss BPM Suite 6 * Red Hat JBoss BRMS 6 * Red Hat JBoss Operations Network 3 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
This vulnerability is out of security support scope for the following product: * Red Hat Mobile Application Platform Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details
This vulnerability is out of security support scope for the following products: * JBoss Developer Studio 11 Please refer to https://access.redhat.com/node/4027141 for more details.
This issue has been addressed in the following products: Red Hat Fuse 7.6.0 Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-11771
Satellite 6.0 was shipping lucene4-contrib which has commons-compress embedded. It is EOL on February 21, 2018. ~~~ [ytale@cordelia manifests]$ cat manifest-eol.txt | grep satellite | grep commons-compres manifest-eol.txt:14677:rhn_satellite:6.0/lucene4-contrib-4.6.1-1.el6sat.noarch.rpm/Commons Compress/1.4.1/commons-compress-1.4.1.jar ~~~ Ref - https://access.redhat.com/support/policy/updates/satellite/