Important: apache-commons-compress

2024-03-1320:26:00

alas.aws.amazon.com

apache commons compress

infinite loop vulnerability

cve-2024-25710

amazon linux 2

yum update

red hat

mitre

unix

security advisory

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.5%

JSON

Issue Overview:

Loop with Unreachable Exit Condition (‘Infinite Loop’) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue. (CVE-2024-25710)

Affected Packages:

apache-commons-compress

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update apache-commons-compress to update your system.

New Packages:

noarch:  
    apache-commons-compress-1.5-4.amzn2.0.1.noarch  
    apache-commons-compress-javadoc-1.5-4.amzn2.0.1.noarch  
  
src:  
    apache-commons-compress-1.5-4.amzn2.0.1.src

Additional References

Red Hat: CVE-2024-25710

Mitre: CVE-2024-25710

OSVersionArchitecturePackageVersionFilename
Amazon Linux2noarchapache-commons-compress< 1.5-4.amzn2.0.1apache-commons-compress-1.5-4.amzn2.0.1.noarch.rpm
Amazon Linux2noarchapache-commons-compress-javadoc< 1.5-4.amzn2.0.1apache-commons-compress-javadoc-1.5-4.amzn2.0.1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	noarch	apache-commons-compress	< 1.5-4.amzn2.0.1	apache-commons-compress-1.5-4.amzn2.0.1.noarch.rpm
Amazon Linux	2	noarch	apache-commons-compress-javadoc	< 1.5-4.amzn2.0.1	apache-commons-compress-javadoc-1.5-4.amzn2.0.1.noarch.rpm