High severity · published Aug 30, 2019
CVE-2019-12402
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs
7.5
CVSS
16.2%
EPSS
No
On KEV
Description
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.2% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Banking Payments · Oracle
14.1.0 through 14.4.0 · source: NVD
BP
Banking Platform · Oracle
2.6.2; 2.7.0; 2.8.0; 2.9.0 · source: NVD
CC
Commons Compress · Apache
1.15 through 1.18 · source: NVD
CE
Communications Element Manager · Oracle
8.2.0 through 8.2.2 · source: NVD
CI
Communications IP Service Activator · Oracle
7.3.0; 7.4.0 · source: NVD
CS
Communications Session Report Manager · Oracle
8.2.0 through 8.2.2 · source: NVD
CS
Communications Session Route Manager · Oracle
8.2.0 through 8.2.2 · source: NVD
CM
Customer Management And Segmentation Foundation · Oracle
18.0 · source: NVD
ES
Essbase · Oracle
21.2 · source: NVD
FE
Fedora · Fedoraproject
30; 31 · source: NVD
FI
Flexcube Investor Servicing · Oracle
12.1.0; 12.3.0; 12.4.0; 14.0.0; 14.1.0 · source: NVD
FP
Flexcube Private Banking · Oracle
12.0.0; 12.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12402
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12402
lists.apache.org
https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3%40%3Cissues.flink.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117%40%3Cissues.flink.apache.org%3E
More from Commons Compress
7.5
CVE-2021-35516
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs
7.5
CVE-2021-35515
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop
7.5
CVE-2021-36090
Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
7.5
CVE-2021-35517
Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
5.5
CVE-2024-26308
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26