Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-25710 · ADVISORY
• apache/commons-compress · PACKAGE
• lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf · WEB
• security.netapp.com/advisory/ntap-20240307-0010 · WEB
• seclists.org/fulldisclosure/2024/Aug/37 · WEB
• openwall.com/lists/oss-security/2024/02/19/1 · WEB
• security.netapp.com/advisory/ntap-20240307-0010

org.apache.commons:commons-compress のその他の脆弱性

• CVE-2024-26308中 5.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: fr…
• CVE-2023-42503中 5.5Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apac…
• CVE-2021-36090高 7.5When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memor…
• CVE-2021-35517高 7.5When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memor…
• CVE-2021-35516高 7.5When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory…