CVE-2024-26308

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.21 before 1.26.

Users are recommended to upgrade to version 1.26, which fixes the issue.

Root has patched CVE-2024-26308 in the io.root.org.apache.commons:commons-compress package for Root:Maven. Multiple fixed versions available.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.21-tuxcare.1.

These are all security issues fixed in the apache-commons-compress-1.26.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for Java fixes the following issues:

apache-commons-codec was updated to version 1.16.1:

• Changes in version 1.16.1:

  • New features:

    • Added Maven property project.build.outputTimestamp for build reproducibility

  • Bugs fixed:

    • Correct error in Base64 Javadoc
    • Added minimum Java version in changes.xml
    • Documentation update for the org.apache.commons.codec.digest.* package
    • Precompile regular expression in UnixCrypt.crypt(byte[], String)
    • Fixed possible IndexOutOfBoundException in PhoneticEngine.encode method
    • Fixed possible ArrayIndexOutOfBoundsException in QuotedPrintableCodec.encodeQuotedPrintable() method
    • Fixed possible StringIndexOutOfBoundException in MatchRatingApproachEncoder.encode() method
    • Fixed possible ArrayIndexOutOfBoundException in RefinedSoundex.getMappingCode()
    • Fixed possible IndexOutOfBoundsException in PercentCodec.insertAlwaysEncodeChars() method
    • Deprecated UnixCrypt 0-argument constructor
    • Deprecated Md5Crypt 0-argument constructor
    • Deprecated Crypt 0-argument constructor
    • Deprecated StringUtils 0-argument constructor
    • Deprecated Resources 0-argument constructor
    • Deprecated Charsets 0-argument constructor
    • Deprecated CharEncoding 0-argument constructor

• Changes in version 1.16.0:

  • Remove duplicated words from Javadocs
  • Use Standard Charset object
  • Use String.contains() functions
  • Avoid use toString() or substring() in favor of a simplified expression
  • Fixed byte-skipping in Base16 decoding
  • Fixed several typos, improve writing in some javadocs
  • BaseNCodecOutputStream.eof() should not throw IOException.
  • Javadoc improvements and cleanups.
  • Deprecated BaseNCodec.isWhiteSpace(byte) and use Character.isWhitespace(int).
  • Added support for Blake3 family of hashes
  • Added github/codeql-action
  • Bump actions/cache from v2 to v3.0.10
  • Bump actions/setup-java from v1.4.1 to 3.5.1
  • Bump actions/checkout from 2.3.2 to 3.1.0
  • Bump commons-parent from 52 to 58
  • Bump junit from 4.13.1 to 5.9.1
  • Bump Java 7 to 8.
  • Bump japicmp-maven-plugin from 0.14.3 to 0.17.1.
  • Bump jacoco-maven-plugin from 0.8.5 to 0.8.8 (Fixes Java 15 builds).
  • Bump maven-surefire-plugin from 2.22.2 to 3.0.0-M7
  • Bump maven-javadoc-plugin from 3.2.0 to 3.4.1.
  • Bump animal-sniffer-maven-plugin from 1.19 to 1.22.
  • Bump maven-pmd-plugin from 3.13.0 to 3.19.0
  • Bump pmd from 6.47.0 to 6.52.0.
  • Bump maven-checkstyle-plugin from 2.17 to 3.2.0
  • Bump checkstyle from 8.45.1 to 9.3
  • Bump taglist-maven-plugin from 2.4 to 3.0.0
  • Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.

apache-commons-compress was updated to version 1.26:

• Changes in version 1.26:

  • Security issues fixed:

    • CVE-2024-26308: Fixed allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress (bsc#1220068)
    • CVE-2024-25710: Fixed loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress (bsc#1220070)

  • New Features:

    • Added and use ZipFile.builder(), ZipFile.Builder, and deprecate constructors
    • Added and use SevenZFile.builder(), SevenZFile.Builder, and deprecate constructors
    • Added and use ArchiveInputStream.getCharset()
    • Added and use ArchiveEntry.resolveIn(Path)
    • Added Maven property project.build.outputTimestamp for build reproducibility

  • Bugs fixed:

    • Check for invalid PAX values in TarArchiveEntry
    • Fixed zero size headers in ArjInputStream
    • Fixes and tests for ArInputStream
    • Fixes for dump file parsing
    • Improved CPIO exception detection and handling
    • Deprecated SkipShieldingInputStream without replacement (nolonger used)
    • Reuse commons-codec, don't duplicate class PureJavaCrc32C (removed package-private class)
    • Reuse commons-codec, don't duplicate class XXHash32 (deprecated class)
    • Reuse commons-io, don't duplicate class…