Apache Commons Compress
By the Year
In 2022 there have been 0 vulnerabilities in Apache Commons Compress . Last year Commons Compress had 4 security vulnerabilities published. Right now, Commons Compress is on track to have less security vulnerabilities in 2022 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2022 | 0 | 0.00 |
| 2021 | 4 | 7.50 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 7.50 |
| 2018 | 2 | 5.50 |
It may take a day or so for new Commons Compress vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Commons Compress Security Vulnerabilities
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory
CVE-2021-36090
7.5 - High
- July 13, 2021
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory
CVE-2021-35517
7.5 - High
- July 13, 2021
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Allocation of Resources Without Limits or Throttling
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory
CVE-2021-35516
7.5 - High
- July 13, 2021
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Allocation of Resources Without Limits or Throttling
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop
CVE-2021-35515
7.5 - High
- July 13, 2021
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Infinite Loop
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18
CVE-2019-12402
7.5 - High
- August 30, 2019
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Infinite Loop
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream
CVE-2018-11771
5.5 - Medium
- August 16, 2018
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
Infinite Loop
A specially crafted ZIP archive
CVE-2018-1324
5.5 - Medium
- March 16, 2018
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Infinite Loop
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1
CVE-2012-2098
- June 29, 2012
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
Cryptographic Issues
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Commons Compress or by Apache? Click the Watch button to subscribe.
