NetSight
IP …
high7.5

CVE-2019-12402

Denial of Service in Apache Commons Compress

Impact

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.commons:commons-compress>= 1.15, < 1.191.19
mavenio.github.1tchy.java9modular.org.apache.commons:commons-compress= 1.18.1none recorded

Affected products

VendorProductAffected versions
ApacheCommons Compress
from 1.15 through 1.18
FedoraprojectFedora
Versions 30, 31
OracleBanking Payments
from 14.1.0 through 14.4.0
OracleBanking Platform
Versions 2.6.2, 2.7.0, 2.8.0, 2.9.0
OracleCommunications Element Manager
from 8.2.0 through 8.2.2
OracleCommunications Ip Service Activator
Versions 7.3.0, 7.4.0
OracleCommunications Session Report Manager
from 8.2.0 through 8.2.2
OracleCommunications Session Route Manager
from 8.2.0 through 8.2.2
OracleCustomer Management And Segmentation Foundation
Version 18.0
OracleEssbase
Version 21.2
OracleFlexcube Investor Servicing
Versions 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0
OracleFlexcube Private Banking
Versions 12.0.0, 12.1.0

Weakness classification

CWE-835

References