Red Hat Bugzilla – Bug 1618573
CVE-2018-11771 apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip
Last modified: 2018-10-18 11:08:00 EDT
Apache Commons Compress versions 1.7 to 1.17 are vulnerable to a denial of service attack via crafted ZIP archive. When reading a specially crafted ZIP archive, the read method of ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package. External Reference: https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330@%3Cannounce.apache.org%3E
Created apache-commons-compress tracking bugs for this issue: Affects: fedora-all [bug 1618574]
Upstream ticket: https://issues.apache.org/jira/browse/COMPRESS-463 Upstream patch: https://github.com/apache/commons-compress/commit/a41ce689 Prior patches introducing tests: https://github.com/apache/commons-compress/commit/0fe6ae31 https://github.com/apache/commons-compress/commit/64ed6dde