CVE-2018-1324: Medium severity apache commons compress vulnerability
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-1324.
What software is affected by this vulnerability?
Apache Commons Compress versions 1.11 to 1.15, Oracle MySQL Cluster versions 7.4.34 to 7.6.20, and Oracle WebLogic Server version 14.1.1.0.0 are affected by this vulnerability.
What is the severity of CVE-2018-1324?
The severity of CVE-2018-1324 is medium with a CVSS score of 5.5.
How can this vulnerability be exploited?
This vulnerability can be exploited by using a specially crafted ZIP archive to cause an infinite loop in the ZipFile and ZipArchiveInputStream classes of Apache Commons Compress.
Are there any fixes or patches available for this vulnerability?
It is recommended to update to a version of Apache Commons Compress, Oracle MySQL Cluster, or Oracle WebLogic Server that is not affected by this vulnerability.