CVE-2012-2098 Uncontrolled Resource Consumption in Apache Commons Compress

What is CVE-2012-2098?

CVE-2012-2098 is a medium-severity denial of service vulnerability in n/a, published on 29 Jun 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.

Weakness: CWE-310

Which versions are affected by CVE-2012-2098?

2 open source packages ship an affected version, including org.apache.commons:commons-compress. It affects 1 product.

Products include Apache Commons Compress.

How do I fix CVE-2012-2098?

Upgrade org.apache.commons:commons-compress to 1.4.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2012-2098 being exploited?

There is no known exploitation of CVE-2012-2098 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file High 8.1
• CVE-2021-35515 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability High 7.5
• CVE-2021-35516 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability High 7.5
• CVE-2021-35517 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability High 7.5
• CVE-2021-36090 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2012-2098, GHSA-6fxm-66hq-fc96, MGASA-2014-0056.