CVE-2018-1324
Summary
| CVE | CVE-2018-1324 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-03-16 13:29:00 UTC |
| Updated | 2023-11-07 02:55:00 UTC |
| Description | A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package. |
Risk And Classification
Problem Types: CWE-835
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Commons-compress | All | All | All | All |
| Application | Apache | Commons Compress | All | All | All | All |
| Application | Oracle | Mysql Cluster | All | All | All | All |
| Application | Oracle | Mysql Cluster | All | All | All | All |
| Application | Oracle | Mysql Cluster | All | All | All | All |
| Application | Oracle | Mysql Cluster | All | All | All | All |
| Application | Oracle | Weblogic Server | 14.1.1.0.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Apache Commons Compress CVE-2018-1324 Multiple Denial Of Service Vulnerabilities | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Oracle Critical Patch Update Advisory - January 2022 | MISC | www.oracle.com | |
| Apache Commons Components Infinite Loop in Parsing ZIP Archives Lets Remote Users Deny Service - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Vendor Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Vendor Advisory |
| Pony Mail! | lists.apache.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981071 Java (maven) Security Update for org.apache.commons:commons-compress (GHSA-h436-432x-8fvx)