Lucene search
GitHub Advisory DatabaseGHSA-4G9R-VXHX-9PGXHistoryFeb 19, 2024 - 9:30 a.m.
Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
2024-02-1909:30:50
CWE-835
GitHub Advisory Database
github.com
26
apache commons compress
denial of service
infinite loop
dump file
vulnerability
upgrade
CVSS3
8.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
6.7
Confidence
High
EPSS
0.001
Percentile
25.8%
Loop with Unreachable Exit Condition (‘Infinite Loop’) vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0.
Users are recommended to upgrade to version 1.26.0 which fixes the issue.
Affected configurations
Node
org.apache.commonscommons-compressRange1.3–1.26.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| org.apache.commons | commons-compress | * | cpe:2.3:a:org.apache.commons:commons-compress:*:*:*:*:*:*:*:* |
Related
ubuntucve
ubuntucve
CVE-2024-25710
2024-02-19 00:00:00
debiancve
debiancve
CVE-2024-25710
2024-02-19 09:15:37
osv
osv
CGA-679f-cjh5-5f6q
2024-06-06 12:24:28
CGA-gr35-gp4q-q78f
2024-06-06 12:27:31
CVE-2024-25710
2024-02-19 09:15:37
vulnrichment
vulnrichment
prion
prion
Design/Logic Flaw
2024-02-19 09:15:00
redhat
redhat
wolfi
wolfi
CVE-2024-25710 vulnerabilities
2024-09-30 03:53:08
nessus
nessus
Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2024-561)
2024-03-21 00:00:00
Amazon Linux 2023 : apache-commons-compress, apache-commons-compress-javadoc (ALAS2023-2024-560)
2024-03-21 00:00:00
Amazon Linux 2 : apache-commons-compress (ALAS-2024-2493)
2024-03-18 00:00:00
cvelist
cvelist
redhatcve
redhatcve
CVE-2024-25710
2024-02-19 20:50:19
openvas
openvas
Apache Commons Compress 1.3 < 1.26.0 DoS Vulnerability
2024-02-20 00:00:00
SUSE: Security Advisory (SUSE-SU-2024:0726-1)
2024-03-01 00:00:00
cve
cve
CVE-2024-25710
2024-02-19 09:15:37
nvd
nvd
CVE-2024-25710
2024-02-19 09:15:37
cgr
cgr
CVE-2024-25710 vulnerabilities
2024-05-19 03:07:16
amazon
amazon
Important: apache-commons-compress
2024-03-13 20:26:00
veracode
veracode
Denial Of Service (DoS)
2024-02-20 06:21:30
atlassian
atlassian
Bitbucket Data Center is affected by CVE-2024-25710
2024-04-03 08:56:14
ibm
ibm
Security Bulletin: IBM Content Navigator is vulnerable to Denial of Service (DoS) due to Apache Commons Compress (CVE-2024-26308, CVE-2024-25710)
2024-08-01 21:17:43
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00
CVSS3
8.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
6.7
Confidence
High
EPSS
0.001
Percentile
25.8%
Related for GHSA-4G9R-VXHX-9PGX