CVE-2024-25710

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Red Hat Lightwell has released org.apache.commons:commons-compress 1.9.0.rhlw-00005 with backported fixes for CVE-2018-11771, CVE-2021-35515, CVE-2021-35517, CVE-2021-36090, and CVE-2024-25710.

CVE-2018-11771: When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.

CVE-2021-35515: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

CVE-2021-35517: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

CVE-2021-36090: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

CVE-2024-25710: Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

This patched artifact is a drop-in replacement for org.apache.commons:commons-compress 1.9.0 from Maven Central.

Root has patched CVE-2024-25710 in the io.root.org.apache.commons:commons-compress package for Root:Maven. Multiple fixed versions available.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

TuxCare rebuilt org.apache.commons:commons-compress to address 5 CVEs. Fixed in 1.20-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-compress to address 4 CVEs. Fixed in 1.19-tuxcare.2.

TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.21-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.24.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.25.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.15-tuxcare.2.

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.14-tuxcare.2.

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.18-tuxcare.3.

TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.4.1-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.8.1-tuxcare.2.

TuxCare rebuilt org.apache.commons:commons-compress to address 3 CVEs. Fixed in 1.9-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.12-tuxcare.2.

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.23.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.22-tuxcare.1.

These are all security issues fixed in the apache-commons-compress-1.26.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for Java fixes the following issues:

apache-commons-codec was updated to version 1.16.1:

• Changes in version 1.16.1:

  • New features:

    • Added Maven property project.build.outputTimestamp for build reproducibility

  • Bugs fixed:

    • Correct error in Base64 Javadoc
    • Added minimum Java version in changes.xml
    • Documentation update for the org.apache.commons.codec.digest.* package
    • Precompile regular expression in UnixCrypt.crypt(byte[], String)
    • Fixed possible IndexOutOfBoundException in PhoneticEngine.encode method
    • Fixed possible ArrayIndexOutOfBoundsException in QuotedPrintableCodec.encodeQuotedPrintable() method
    • Fixed possible StringIndexOutOfBoundException in MatchRatingApproachEncoder.encode() method
    • Fixed possible ArrayIndexOutOfBoundException in RefinedSoundex.getMappingCode()
    • Fixed possible IndexOutOfBoundsException in PercentCodec.insertAlwaysEncodeChars() method
    • Deprecated UnixCrypt 0-argument constructor
    • Deprecated Md5Crypt 0-argument constructor
    • Deprecated Crypt 0-argument constructor
    • Deprecated StringUtils 0-argument constructor
    • Deprecated Resources 0-argument constructor
    • Deprecated Charsets 0-argument constructor
    • Deprecated CharEncoding 0-argument constructor

• Changes in version 1.16.0:

  • Remove duplicated words from Javadocs
  • Use Standard Charset object
  • Use String.contains() functions
  • Avoid use toString() or substring() in favor of a simplified expression
  • Fixed byte-skipping in Base16 decoding
  • Fixed several typos, improve writing in some javadocs
  • BaseNCodecOutputStream.eof() should not throw IOException.
  • Javadoc improvements and cleanups.
  • Deprecated BaseNCodec.isWhiteSpace(byte) and use Character.isWhitespace(int).
  • Added support for Blake3 family of hashes
  • Added github/codeql-action
  • Bump actions/cache from v2 to v3.0.10
  • Bump actions/setup-java from v1.4.1 to 3.5.1
  • Bump actions/checkout from 2.3.2 to 3.1.0
  • Bump commons-parent from 52 to 58
  • Bump junit from 4.13.1 to 5.9.1
  • Bump Java 7 to 8.
  • Bump japicmp-maven-plugin from 0.14.3 to 0.17.1.
  • Bump jacoco-maven-plugin from 0.8.5 to 0.8.8 (Fixes Java 15 builds).
  • Bump maven-surefire-plugin from 2.22.2 to 3.0.0-M7
  • Bump maven-javadoc-plugin from 3.2.0 to 3.4.1.
  • Bump animal-sniffer-maven-plugin from 1.19 to 1.22.
  • Bump maven-pmd-plugin from 3.13.0 to 3.19.0
  • Bump pmd from 6.47.0 to 6.52.0.
  • Bump maven-checkstyle-plugin from 2.17 to 3.2.0
  • Bump checkstyle from 8.45.1 to 9.3
  • Bump taglist-maven-plugin from 2.4 to 3.0.0
  • Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.

apache-commons-compress was updated to version 1.26:

• Changes in version 1.26:

  • Security issues fixed:

    • CVE-2024-26308: Fixed allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress (bsc#1220068)
    • CVE-2024-25710: Fixed loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress (bsc#1220070)

  • New Features:

    • Added and use ZipFile.builder(), ZipFile.Builder, and deprecate constructors
    • Added and use SevenZFile.builder(), SevenZFile.Builder, and deprecate constructors
    • Added and use ArchiveInputStream.getCharset()
    • Added and use ArchiveEntry.resolveIn(Path)
    • Added Maven property project.build.outputTimestamp for build reproducibility

  • Bugs fixed:

    • Check for invalid PAX values in TarArchiveEntry
    • Fixed zero size headers in ArjInputStream
    • Fixes and tests for ArInputStream
    • Fixes for dump file parsing
    • Improved CPIO exception detection and handling
    • Deprecated SkipShieldingInputStream without replacement (nolonger used)
    • Reuse commons-codec, don't duplicate class PureJavaCrc32C (removed package-private class)
    • Reuse commons-codec, don't duplicate class XXHash32 (deprecated class)
    • Reuse commons-io, don't duplicate class…