CVE-2019-12402: High severity Apache Commons Compress vulnerability
A resource consumption vulnerability was discovered in apache-commons-compress in the way NioZipEncoding encodes filenames. Applications that use Compress to create archives, with one of the filenames within the archive being controlled by the user, may be vulnerable to this flaw. A remote attacker could exploit this flaw to cause an infinite loop during the archive creation, thus leading to a denial of service.
Other sources
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-12402?
CVE-2019-12402 is a vulnerability in Apache Commons Compress versions 1.15 to 1.18 that allows resource consumption attacks through a file name encoding algorithm.
What is the severity of CVE-2019-12402?
The severity of CVE-2019-12402 is high, with a CVSS severity score of 7.5.
Which software packages are affected by CVE-2019-12402?
Apache Commons Compress versions 1.15 to 1.18, io.github.1tchy.java9modular.org.apache.commons:commons-compress 1.18.1, and org.apache.commons:commons-compress versions 1.15 to 1.19 are affected by CVE-2019-12402.
How can an application be vulnerable to CVE-2019-12402?
Applications that use Compress to create archives, with one of the filenames within the archive being controlled by the user, may be vulnerable to CVE-2019-12402.
Where can I find more information about CVE-2019-12402?
You can find more information about CVE-2019-12402 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2019-12402) and the NIST National Vulnerability Database (https://nvd.nist.gov/vuln/detail/CVE-2019-12402).