CVE-2018-1324
- State
- Published
- Severity
- Not scored
- Published
- Mar 16, 2018
- Updated
- Sep 17, 2024
- Reserved
- Dec 7, 2017
Description
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache Commons CompressApache Software Foundation |
|
References
- 1040549vdb-entry
- [dev] 20180316 [CVE-2018-1324] Apache Commons Compress denial of service vulnerabilitymailing-list
- 103490vdb-entry
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1mailing-list
- [creadur-dev] 20190530 [Discuss] RAT-244 - update to language level 1.7 due to CVE issues in RATmailing-list
- [beam-issues] 20200421 [jira] [Closed] (BEAM-3873) Current version of commons-compress is DOS vulnerable CVE-2018-1324mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.