CVE-2024-26308: Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
First published: Mon Feb 19 2024(Updated: )
<a href="https://access.redhat.com/security/cve/CVE-2024-25710">CVE-2024-25710</a> (<a href="https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf">https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf</a>): Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. <a href="https://access.redhat.com/security/cve/CVE-2024-26308">CVE-2024-26308</a> (<a href="https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg">https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg</a>): Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue. Please bump to 1.26.0.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/Apache Commons Compress | <1.26 | 1.26 |
| maven/org.apache.commons:commons-compress | >=1.21<1.26.0 | 1.26.0 |
| Apache Commons Compress | >=1.21<1.26.0 | |
| IBM Security Verify Governance - Identity Manager | <=ISVG 10.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2024/02/19/2
- https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg
- https://security.netapp.com/advisory/ntap-20240307-0009/
- https://nvd.nist.gov/vuln/detail/CVE-2024-26308
- https://security.netapp.com/advisory/ntap-20240307-0009
- https://github.com/advisories/GHSA-4265-ccf5-phj5 (Advisory)
- https://access.redhat.com/security/cve/CVE-2024-25710
- https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf
- https://access.redhat.com/security/cve/CVE-2024-26308
- https://access.redhat.com/errata/RHSA-2024:1509
- https://access.redhat.com/errata/RHSA-2024:1662
- https://access.redhat.com/errata/RHSA-2024:1923
- https://access.redhat.com/errata/RHSA-2024:1797
- https://access.redhat.com/errata/RHSA-2024:2833
- https://access.redhat.com/errata/RHSA-2024:3989
- https://access.redhat.com/errata/RHSA-2024:4057
- https://bugzilla.redhat.com/show_bug.cgi?id=2264989
- https://exchange.xforce.ibmcloud.com/vulnerabilities/283469
- https://www.ibm.com/support/pages/node/7172200 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-26308?
The severity of CVE-2024-26308 is currently classified as moderate.
How do I fix CVE-2024-26308?
To fix CVE-2024-26308, upgrade Apache Commons Compress to version 1.26.0 or later.
What software is affected by CVE-2024-26308?
CVE-2024-26308 affects Apache Commons Compress versions between 1.21 and 1.26.0, as well as associated products like IBM Security Verify Governance 10.0.2 and earlier.
What type of vulnerability is reported in CVE-2024-26308?
CVE-2024-26308 represents an infinite loop vulnerability that can lead to denial of service.
Are there any known exploits for CVE-2024-26308?
As of now, no public exploits for CVE-2024-26308 have been reported.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-26308
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/source
- agent/references
- agent/trending
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4265-ccf5-phj5
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/description
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/ibm-support
- source/IBM
- package-manager/redhat
- package-manager/maven
- vendor/apache
- canonical/apache commons compress
- version/apache commons compress/1.21
- vendor/ibm
- canonical/ibm security verify governance - identity manager
- version/ibm security verify governance - identity manager/isvg 10.0.2