Bug 2295031 (CVE-2023-42503) - CVE-2023-42503 apache-commons-compress: Denial of service via CPU consumption for malformed TAR file
Summary: CVE-2023-42503 apache-commons-compress: Denial of service via CPU consumption...
Keywords:
Status: NEW
Alias: CVE-2023-42503
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-01 19:54 UTC by Chess Hazlett
Modified: 2024-07-03 16:26 UTC (History)
19 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
A flaw was found in Apache Commons Compress, where it would permit the creation of a malformed TAR file by manipulating file modification time headers. This issue can lead to excessive CPU consumption and a denial of service, affecting the availability.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Chess Hazlett 2024-07-01 19:54:40 UTC 
Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.
Note You need to log in before you can comment on or make changes to this bug.