The vulnerability of the Apache Commons Compress library, related to uncontrolled resource consumption, allows attackers to influence the accessibility of protected information.

🗓️ 10 Apr 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 7 Views

Apache Commons Compress vulnerability causes resource exhaustion in corrupted Pack200 decompression.

Reporter	Title	Published	Views	Family All 173
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	2 Jul 202616:17	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of Service in Apache Commons Compress used by Apache Solr affect IBM Operations Analytics - Log Analysis (CVE-2024-25710, CVE-2024-26308)	28 Apr 202509:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with OpenJDK, commons-compress and spring-web-5.3.27/spring-web-5.3.32 affect IBM Cloud Object Storage Systems (April 2024v1)	1 Apr 202416:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Controller is affected by vulnerabilities	15 Apr 202503:15	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in commons-compress-1.21.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2024-25710, CVE-2024-26308)	9 Aug 202410:05	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Commons Compress is vulnerable to CVE-2024-26308 and CVE-2024-25710 used in IBM Maximo Application Suite - Monitor Component	2 May 202419:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Commons	5 Jun 202420:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in commons-compress-1.21.jar affects IBM SPSS Collaboration and Deployment Services (CVE-2024-25710, CVE-2024-26308)	6 Mar 202514:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation Fixes for June 2024.	29 Jan 202521:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for June 2024 - Multiple CVEs addressed	7 Aug 202405:53	–	ibm

Vulners

Node

apache commons_compressRange1.21–1.26

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/02/19/2
lists	www.lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg
github	www.github.com/opensearch-project/data-prepper/pull/4172
github	www.github.com/opensearch-project/data-prepper/issues/4163
web	www.web.nvd.nist.gov/view/vuln/detail

10 Apr 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 24.9

CVSS 35.5

EPSS0.00898

apache commons compress resource exhaustion pack200 decompression corrupted pack200 file vulnerability