CVE-2019-12402

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 30-08-2019 11:15

Last modified: - 14-05-2022 05:15

Total changes: - 8

Description

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

7.5

Base score

3.9

3.6

Exploitability score

Impact score

Verification logic

vendor=apache AND product=commons_compress AND versionEndIncluding=1.18 AND versionStartIncluding=1.15

vendor=fedoraproject AND product=fedora AND version=30

vendor=fedoraproject AND product=fedora AND version=31

vendor=oracle AND product=flexcube_investor_servicing AND version=12.3.0

vendor=oracle AND product=flexcube_investor_servicing AND version=12.1.0

vendor=oracle AND product=retail_xstore_point_of_service AND version=15.0

vendor=oracle AND product=flexcube_private_banking AND version=12.1.0

vendor=oracle AND product=flexcube_private_banking AND version=12.0.0

vendor=oracle AND product=retail_integration_bus AND version=15.0

vendor=oracle AND product=webcenter_portal AND version=12.2.1.3.0

vendor=oracle AND product=flexcube_investor_servicing AND version=12.4.0

vendor=oracle AND product=peoplesoft_enterprise_pt_peopletools AND version=8.56

vendor=oracle AND product=retail_xstore_point_of_service AND version=16.0

vendor=oracle AND product=banking_payments AND versionEndIncluding=14.4.0 AND versionStartIncluding=14.1.0

vendor=oracle AND product=banking_platform AND version=2.6.2

vendor=oracle AND product=banking_platform AND version=2.7.0

vendor=oracle AND product=banking_platform AND version=2.8.0

vendor=oracle AND product=banking_platform AND version=2.9.0

vendor=oracle AND product=communications_ip_service_activator AND version=7.3.0

vendor=oracle AND product=communications_ip_service_activator AND version=7.4.0

vendor=oracle AND product=communications_session_route_manager AND versionEndIncluding=8.2.2 AND versionStartIncluding=8.2.0

vendor=oracle AND product=customer_management_and_segmentation_foundation AND version=18.0

vendor=oracle AND product=flexcube_investor_servicing AND version=14.0.0

vendor=oracle AND product=flexcube_investor_servicing AND version=14.1.0

vendor=oracle AND product=hyperion_infrastructure_technology AND version=11.1.2.4

vendor=oracle AND product=jdeveloper AND version=12.2.1.4.0

vendor=oracle AND product=primavera_gateway AND versionEndIncluding=18.8.8 AND versionStartIncluding=18.8.0

vendor=oracle AND product=primavera_gateway AND version=19.12.0

vendor=oracle AND product=retail_integration_bus AND version=16.0

vendor=oracle AND product=retail_xstore_point_of_service AND version=17.0

vendor=oracle AND product=retail_xstore_point_of_service AND version=18.0

vendor=oracle AND product=retail_xstore_point_of_service AND version=19.0

vendor=oracle AND product=webcenter_portal AND version=12.2.1.4.0

vendor=oracle AND product=communications_element_manager AND versionEndIncluding=8.2.2 AND versionStartIncluding=8.2.0

vendor=oracle AND product=communications_session_report_manager AND versionEndIncluding=8.2.2 AND versionStartIncluding=8.2.0

vendor=oracle AND product=essbase AND version=21.2

vendor=oracle AND product=peoplesoft_enterprise_pt_peopletools AND version=8.57

vendor=oracle AND product=peoplesoft_enterprise_pt_peopletools AND version=8.58

Reference

https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b@%3Cdev.commons.apache.org%3E
[creadur-commits] 20191022 [creadur-rat] branch master updated: RAT-258: Update to latest commons-compress to fix CVE-2019-12402-Issue Tracking, Mailing List, Patch, Third Party Advisory
FEDORA-2019-c96a8d12b0-Mailing List, Third Party Advisory
FEDORA-2019-da0eac1eb6-Mailing List, Third Party Advisory
[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200306 [GitHub] [flink] nielsbasjes opened a new pull request #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200306 [GitHub] [flink] flinkbot edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200306 [GitHub] [flink] flinkbot commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Mailing List, Third Party Advisory
[flink-issues] 20200310 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200311 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200311 [GitHub] [flink] nielsbasjes commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200311 [GitHub] [flink] flinkbot edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200311 [GitHub] [flink] nielsbasjes edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200312 [GitHub] [flink] zentol commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200312 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200313 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200313 [GitHub] [flink] zentol commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[flink-issues] 20200313 [GitHub] [flink] GJL closed pull request #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402-Issue Tracking, Mailing List, Third Party Advisory
[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1-Issue Tracking, Mailing List, Third Party Advisory
[lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1-Issue Tracking, Mailing List, Third Party Advisory
[brooklyn-dev] 20200403 [GitHub] [brooklyn-server] nakomis opened a new pull request #1089: Bumps commons-compress version-Issue Tracking, Mailing List, Third Party Advisory
N/A-Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
N/A-Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html

Keywords

CVE-2019-12402

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2019-12402

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures