Lucene search

IBM63E97EE79A6570DBA544550FC5DF8BE2C8A41E24FA160EBF78E0A0A573148655

HistoryFeb 22, 2020 - 12:18 a.m.

Security Bulletin: Vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus (CVE-2019-12402).

2020-02-2200:18:16

www.ibm.com

0.005 Low

EPSS

Percentile

76.3%

JSON

Summary

A denial of service vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus.

Vulnerability Details

CVEID:CVE-2019-12402
**DESCRIPTION:**Apache Commons Compress is vulnerable to a denial of service, caused by an error in the internal file name encoding algorithm. By choosing the file names inside of a specially crafted archive, a remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165956 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
Spectrum Protect Plus	10.1.0-10.1.5

Remediation/Fixes

Spectrum Protect Plus Release	First Fixing VRM Level	Platform	Link to Fix
10.1	10.1.5 patch1	Linux	<http://www.ibm.com/support/docview.wss?uid=ibm11072392>

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm spectrum protect pluseq10.1

CPE	Name	Operator	Version
	ibm spectrum protect plus	eq	10.1

0.005 Low

EPSS

Percentile

76.3%

JSON

Related for 63E97EE79A6570DBA544550FC5DF8BE2C8A41E24FA160EBF78E0A0A573148655