CVE-2019-12402 Denial of Service in Apache Commons Compress
An attacker can cause a denial of service via an infinite loop in Apache Commons Compress by providing specially crafted file names in an archive.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12402?
CVE-2019-12402 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Weakness: CWE-835
Which versions are affected by CVE-2019-12402?
4 open source packages ship an affected version, including io.github.1tchy.java9modular.org.apache.commons:commons-compress and org.apache.commons:commons-compress. It affects 19 products.
| Package | Affected | Fixed in |
|---|---|---|
io.github.1tchy.java9modular.org.apache.commons:commons-compress Maven | All versions | None |
io.github.1tchy.java9modular.org.apache.commons:commons-compress Maven | All versions | None |
org.apache.commons:commons-compress Maven | From 1.15 | 1.19 |
org.apache.commons:commons-compress Maven | From 1.15 | 1.19 |
Products include Apache Commons Compress, Fedoraproject Fedora, Oracle Banking Payments, Oracle Banking Platform, Oracle Communications Element Manager, Oracle Communications Ip Service Activator and 13 more.
How do I fix CVE-2019-12402?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-12402 being exploited?
There is no known exploitation of CVE-2019-12402 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
- CVE-2021-35515 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- CVE-2021-35516 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- CVE-2021-35517 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
- CVE-2021-36090 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
Sources
Also known as CLSA-2026-1784769508, DEBIAN-CVE-2019-12402, GHSA-53x6-4x5p-rrvv, MGASA-2020-0001, UBUNTU-CVE-2019-12402.