QwikSec

Security Database

CVE

CWE

Training

CVE-2018-1324

Published: Mar 16, 2018

Modified: Sep 17, 2024

PUBLISHED

Description

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

Vendor	Product	Versions
Apache Software Foundation	Apache Commons Compress	affected `1.11 to 1.15`

References

vdb-entry

x_refsource_SECTRACK

[dev] 20180316 [CVE-2018-1324] Apache Commons Compress denial of service vulnerability

mailing-list

x_refsource_MLIST

vdb-entry

x_refsource_BID

[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1

mailing-list

x_refsource_MLIST

[creadur-dev] 20190530 [Discuss] RAT-244 - update to language level 1.7 due to CVE issues in RAT

mailing-list

x_refsource_MLIST

[beam-issues] 20200421 [jira] [Closed] (BEAM-3873) Current version of commons-compress is DOS vulnerable CVE-2018-1324

mailing-list

x_refsource_MLIST

https://www.oracle.com/security-alerts/cpujan2022.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.