CVE-2019-12402

HIGH

Apache Commons Compress <1.19 - DoS

Title source: llm

Description

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Exploits (2)

nomisec STUB

by dawetmaster · poc

https://github.com/dawetmaster/CVE-2019-12402-commons-compress-vulnerable

View Code ZIP pw:eip

nomisec WRITEUP

by andikahilmy · poc

https://github.com/andikahilmy/CVE-2019-12402-commons-compress-vulnerable

View Code ZIP pw:eip

References (30)

[Mailing List] https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E

[Third Party Advisory] https://www.oracle.com//security-alerts/cpujul2021.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpuApr2021.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpuapr2020.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpuapr2022.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpujan2021.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpujul2020.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpuoct2020.html

[Not Applicable, Third Party Advisory] https://www.oracle.com/security-alerts/cpuoct2021.html

[Vendor Advisory] https://security.netapp.com/advisory/ntap-20230818-0001/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL/

[Mailing List] https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3%40%3Cissues.flink.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117%40%3Cissues.flink.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521%40%3Cissues.flink.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5%40%3Cissues.flink.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0%40%3Cissues.flink.apache.org%3E

... and 10 more

Scores

CVSS v3 7.5

EPSS 0.0042

EPSS Percentile 62.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-835

Status published

Products (40)

apache/commons_compress 1.15 - 1.18

fedoraproject/fedora 30

fedoraproject/fedora 31

io.github.1tchy.java9modular.org.apache.commons/commons-compress Maven

oracle/banking_payments 14.1.0 - 14.4.0

oracle/banking_platform 2.6.2

oracle/banking_platform 2.7.0

oracle/banking_platform 2.8.0

oracle/banking_platform 2.9.0

oracle/communications_element_manager 8.2.0 - 8.2.2

... and 30 more

Published Aug 30, 2019

Tracked Since Feb 18, 2026