1*ba8755cbSAndroid Build Coastguard Worker<?xml version="1.0"?> 2*ba8755cbSAndroid Build Coastguard Worker<!-- 3*ba8755cbSAndroid Build Coastguard Worker 4*ba8755cbSAndroid Build Coastguard Worker Licensed to the Apache Software Foundation (ASF) under one or more 5*ba8755cbSAndroid Build Coastguard Worker contributor license agreements. See the NOTICE file distributed with 6*ba8755cbSAndroid Build Coastguard Worker this work for additional information regarding copyright ownership. 7*ba8755cbSAndroid Build Coastguard Worker The ASF licenses this file to You under the Apache License, Version 2.0 8*ba8755cbSAndroid Build Coastguard Worker (the "License"); you may not use this file except in compliance with 9*ba8755cbSAndroid Build Coastguard Worker the License. You may obtain a copy of the License at 10*ba8755cbSAndroid Build Coastguard Worker 11*ba8755cbSAndroid Build Coastguard Worker http://www.apache.org/licenses/LICENSE-2.0 12*ba8755cbSAndroid Build Coastguard Worker 13*ba8755cbSAndroid Build Coastguard Worker Unless required by applicable law or agreed to in writing, software 14*ba8755cbSAndroid Build Coastguard Worker distributed under the License is distributed on an "AS IS" BASIS, 15*ba8755cbSAndroid Build Coastguard Worker WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16*ba8755cbSAndroid Build Coastguard Worker See the License for the specific language governing permissions and 17*ba8755cbSAndroid Build Coastguard Worker limitations under the License. 18*ba8755cbSAndroid Build Coastguard Worker--> 19*ba8755cbSAndroid Build Coastguard Worker<document> 20*ba8755cbSAndroid Build Coastguard Worker <properties> 21*ba8755cbSAndroid Build Coastguard Worker <title>Commons Compress Security Reports</title> 22*ba8755cbSAndroid Build Coastguard Worker <author email="[email protected]">Commons Documentation Team</author> 23*ba8755cbSAndroid Build Coastguard Worker </properties> 24*ba8755cbSAndroid Build Coastguard Worker <body> 25*ba8755cbSAndroid Build Coastguard Worker <section name="General Information"> 26*ba8755cbSAndroid Build Coastguard Worker <p>For information about reporting or asking questions about 27*ba8755cbSAndroid Build Coastguard Worker security problems, please see the <a 28*ba8755cbSAndroid Build Coastguard Worker href="https://commons.apache.org/security.html">security page 29*ba8755cbSAndroid Build Coastguard Worker of the Commons project</a>.</p> 30*ba8755cbSAndroid Build Coastguard Worker </section> 31*ba8755cbSAndroid Build Coastguard Worker 32*ba8755cbSAndroid Build Coastguard Worker <section name="Apache Commons Compress Security Vulnerabilities"> 33*ba8755cbSAndroid Build Coastguard Worker <p>This page lists all security vulnerabilities fixed in 34*ba8755cbSAndroid Build Coastguard Worker released versions of Apache Commons Compress. Each 35*ba8755cbSAndroid Build Coastguard Worker vulnerability is given a security impact rating by the 36*ba8755cbSAndroid Build Coastguard Worker development team - please note that this rating may vary from 37*ba8755cbSAndroid Build Coastguard Worker platform to platform. We also list the versions of Commons 38*ba8755cbSAndroid Build Coastguard Worker Compress the flaw is known to affect, and where a flaw has not 39*ba8755cbSAndroid Build Coastguard Worker been verified list the version with a question mark.</p> 40*ba8755cbSAndroid Build Coastguard Worker 41*ba8755cbSAndroid Build Coastguard Worker <p>Please note that binary patches are never provided. If you 42*ba8755cbSAndroid Build Coastguard Worker need to apply a source code patch, use the building 43*ba8755cbSAndroid Build Coastguard Worker instructions for the Commons Compress version that you are 44*ba8755cbSAndroid Build Coastguard Worker using.</p> 45*ba8755cbSAndroid Build Coastguard Worker 46*ba8755cbSAndroid Build Coastguard Worker <p>If you need help on building Commons Compress or other help 47*ba8755cbSAndroid Build Coastguard Worker on following the instructions to mitigate the known 48*ba8755cbSAndroid Build Coastguard Worker vulnerabilities listed here, please send your questions to the 49*ba8755cbSAndroid Build Coastguard Worker public <a href="mail-lists.html">Compress Users mailing 50*ba8755cbSAndroid Build Coastguard Worker list</a>.</p> 51*ba8755cbSAndroid Build Coastguard Worker 52*ba8755cbSAndroid Build Coastguard Worker <p>If you have encountered an unlisted security vulnerability 53*ba8755cbSAndroid Build Coastguard Worker or other unexpected behaviour that has security impact, or if 54*ba8755cbSAndroid Build Coastguard Worker the descriptions here are incomplete, please report them 55*ba8755cbSAndroid Build Coastguard Worker privately to the Apache Security Team. Thank you.</p> 56*ba8755cbSAndroid Build Coastguard Worker 57*ba8755cbSAndroid Build Coastguard Worker <subsection name="Fixed in Apache Commons Compress 1.18"> 58*ba8755cbSAndroid Build Coastguard Worker <p><b>Low: Denial of Service</b> <a 59*ba8755cbSAndroid Build Coastguard Worker href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11771">CVE-2018-11771</a></p> 60*ba8755cbSAndroid Build Coastguard Worker 61*ba8755cbSAndroid Build Coastguard Worker <p>When reading a specially crafted ZIP archive, the read 62*ba8755cbSAndroid Build Coastguard Worker method of <code>ZipArchiveInputStream</code> can fail to 63*ba8755cbSAndroid Build Coastguard Worker return the correct EOF indication after the end of the 64*ba8755cbSAndroid Build Coastguard Worker stream has been reached. When combined with a 65*ba8755cbSAndroid Build Coastguard Worker <code>java.io.InputStreamReader</code> this can lead to an 66*ba8755cbSAndroid Build Coastguard Worker infinite stream, which can be used to mount a denial of 67*ba8755cbSAndroid Build Coastguard Worker service attack against services that use Compress' zip 68*ba8755cbSAndroid Build Coastguard Worker package</p> 69*ba8755cbSAndroid Build Coastguard Worker 70*ba8755cbSAndroid Build Coastguard Worker <p>This was fixed in revision <a 71*ba8755cbSAndroid Build Coastguard Worker href="https://git-wip-us.apache.org/repos/asf?p=commons-compress.git;a=blobdiff;f=src/main/java/org/apache/commons/compress/archivers/zip/ZipArchiveInputStream.java;h=e1995d7aa51dfac6ae933987fb0b7760c607582b;hp=0a2c1aa0063c620c867715119eae2013c87b5e70;hb=a41ce6892cb0590b2e658704434ac0dbcb6834c8;hpb=64ed6dde03afbef6715fdfdeab5fc04be6192899">a41ce68</a>.</p> 72*ba8755cbSAndroid Build Coastguard Worker 73*ba8755cbSAndroid Build Coastguard Worker <p>This was first reported to the Security Team on 14 June 74*ba8755cbSAndroid Build Coastguard Worker 2018 and made public on 16 August 2018.</p> 75*ba8755cbSAndroid Build Coastguard Worker 76*ba8755cbSAndroid Build Coastguard Worker <p>Affects: 1.7 - 1.17</p> 77*ba8755cbSAndroid Build Coastguard Worker 78*ba8755cbSAndroid Build Coastguard Worker </subsection> 79*ba8755cbSAndroid Build Coastguard Worker 80*ba8755cbSAndroid Build Coastguard Worker <subsection name="Fixed in Apache Commons Compress 1.16"> 81*ba8755cbSAndroid Build Coastguard Worker <p><b>Low: Denial of Service</b> <a 82*ba8755cbSAndroid Build Coastguard Worker href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1324">CVE-2018-1324</a></p> 83*ba8755cbSAndroid Build Coastguard Worker 84*ba8755cbSAndroid Build Coastguard Worker <p>A specially crafted ZIP archive can be used to cause an 85*ba8755cbSAndroid Build Coastguard Worker infinite loop inside of Compress' extra field parser used by 86*ba8755cbSAndroid Build Coastguard Worker the <code>ZipFile</code> and 87*ba8755cbSAndroid Build Coastguard Worker <code>ZipArchiveInputStream</code> classes. This can be 88*ba8755cbSAndroid Build Coastguard Worker used to mount a denial of service attack against services 89*ba8755cbSAndroid Build Coastguard Worker that use Compress' zip package.</p> 90*ba8755cbSAndroid Build Coastguard Worker 91*ba8755cbSAndroid Build Coastguard Worker <p>This was fixed in revision <a 92*ba8755cbSAndroid Build Coastguard Worker href="https://git-wip-us.apache.org/repos/asf?p=commons-compress.git;a=blobdiff;f=src/main/java/org/apache/commons/compress/archivers/zip/X0017_StrongEncryptionHeader.java;h=acc3b22346b49845e85b5ef27a5814b69e834139;hp=0feb9c98cc622cde1defa3bbd268ef82b4ae5c18;hb=2a2f1dc48e22a34ddb72321a4db211da91aa933b;hpb=dcb0486fb4cb2b6592c04d6ec2edbd3f690df5f2">2a2f1dc4</a>.</p> 93*ba8755cbSAndroid Build Coastguard Worker 94*ba8755cbSAndroid Build Coastguard Worker <p>This was first reported to the project's JIRA on <a 95*ba8755cbSAndroid Build Coastguard Worker href="https://issues.apache.org/jira/browse/COMPRESS-432">19 96*ba8755cbSAndroid Build Coastguard Worker December 2017</a>.</p> 97*ba8755cbSAndroid Build Coastguard Worker 98*ba8755cbSAndroid Build Coastguard Worker <p>Affects: 1.11 - 1.15</p> 99*ba8755cbSAndroid Build Coastguard Worker 100*ba8755cbSAndroid Build Coastguard Worker </subsection> 101*ba8755cbSAndroid Build Coastguard Worker 102*ba8755cbSAndroid Build Coastguard Worker <subsection name="Fixed in Apache Commons Compress 1.4.1"> 103*ba8755cbSAndroid Build Coastguard Worker <p><b>Low: Denial of Service</b> <a 104*ba8755cbSAndroid Build Coastguard Worker href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098">CVE-2012-2098</a></p> 105*ba8755cbSAndroid Build Coastguard Worker 106*ba8755cbSAndroid Build Coastguard Worker <p>The bzip2 compressing streams in Apache Commons Compress 107*ba8755cbSAndroid Build Coastguard Worker internally use sorting algorithms with unacceptable 108*ba8755cbSAndroid Build Coastguard Worker worst-case performance on very repetitive inputs. A 109*ba8755cbSAndroid Build Coastguard Worker specially crafted input to Compress' 110*ba8755cbSAndroid Build Coastguard Worker <code>BZip2CompressorOutputStream</code> can be used to make 111*ba8755cbSAndroid Build Coastguard Worker the process spend a very long time while using up all 112*ba8755cbSAndroid Build Coastguard Worker available processing time effectively leading to a denial of 113*ba8755cbSAndroid Build Coastguard Worker service.</p> 114*ba8755cbSAndroid Build Coastguard Worker 115*ba8755cbSAndroid Build Coastguard Worker <p>This was fixed in revisions 116*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1332540">1332540</a>, 117*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1332552">1332552</a>, 118*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1333522">1333522</a>, 119*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1337444">1337444</a>, 120*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340715">1340715</a>, 121*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340723">1340723</a>, 122*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340757">1340757</a>, 123*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340786">1340786</a>, 124*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340787">1340787</a>, 125*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340790">1340790</a>, 126*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340795">1340795</a> and 127*ba8755cbSAndroid Build Coastguard Worker <a href="https://svn.apache.org/viewvc?view=revision&revision=1340799">1340799</a>.</p> 128*ba8755cbSAndroid Build Coastguard Worker 129*ba8755cbSAndroid Build Coastguard Worker <p>This was first reported to the Security Team on 12 April 130*ba8755cbSAndroid Build Coastguard Worker 2012 and made public on 23 May 2012.</p> 131*ba8755cbSAndroid Build Coastguard Worker 132*ba8755cbSAndroid Build Coastguard Worker <p>Affects: 1.0 - 1.4</p> 133*ba8755cbSAndroid Build Coastguard Worker 134*ba8755cbSAndroid Build Coastguard Worker </subsection> 135*ba8755cbSAndroid Build Coastguard Worker </section> 136*ba8755cbSAndroid Build Coastguard Worker 137*ba8755cbSAndroid Build Coastguard Worker <section name="Errors and Ommissions"> 138*ba8755cbSAndroid Build Coastguard Worker <p>Please report any errors or omissions to <a 139*ba8755cbSAndroid Build Coastguard Worker href="mail-lists.html">the dev mailing list</a>.</p> 140*ba8755cbSAndroid Build Coastguard Worker </section> 141*ba8755cbSAndroid Build Coastguard Worker </body> 142*ba8755cbSAndroid Build Coastguard Worker</document> 143