Resource exhaustion in Apache Commons Compress - CVE-2023-42503

Vulnerability identifier: #VU80788

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-42503

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing .tar archives. A remote attacker can pass a specially crafted archive to the application and consume excessive CPU usage.

Apache Commons Compress
Voice Gateway
Communications Service Catalog and Design
Oracle Communications Instant Messaging Server
Oracle Utilities Network Management System
IBM Cloud Pak for Watson AIOps
Oracle Transportation Management
Oracle Financial Services Analytical Applications Infrastructure
IBM Business Automation Manager Open Editions
ObjectScale
IBM Planning Analytics Workspace
User Entity Behavior Analytics
Storage Insights - Data Collector
Oracle Banking Party Management
IBM Watson Discovery for IBM Cloud Pak for Data
Oracle Communications Unified Inventory Management
Oracle Financial Services Behavior Detection Platform
IBM Maximo Application Suite
Oracle Life Sciences Empirica Signal
Enterprise Manager Base Platform
Primavera P6 Enterprise Project Portfolio Management
IBM Cloud Pak for Business Automation
IBM Spectrum Control
IBM Automation Decision Services
IBM Qradar SIEM
PeopleSoft Enterprise PeopleTools
IBM Security Guardium
Oracle WebCenter Portal
Oracle WebLogic Server
Primavera Unifier
Oracle Essbase

Install updates from vendor's website.

Apache Commons Compress - update to 1.24.0
Voice Gateway - update to 1.0.8.19
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
IBM Maximo Application Suite - addressed in versions 8.9.11, 8.10.6, 8.11.1
IBM Business Automation Manager Open Editions - update to 9.0.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
ObjectScale - update to 1.4.0
IBM Planning Analytics Workspace - update to 2.0.93
User Entity Behavior Analytics - update to 5.0.2
IBM Spectrum Control - update to 5.4.12
IBM Automation Decision Services - update to 23.0.1 IF006
Storage Insights - Data Collector - update to 20231107-2300

• https://issues.apache.org/jira/browse/COMPRESS-612
• https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05

• Denial of service in Apache Commons Compress
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Watson Discovery Cartridge for IBM Cloud Pak for Data update for Apache Commons Compress
• IBM Maximo Application Suite - Monitor Component update for Apache Commons Compress
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• IBM Storage Insights - Data Collector update for Apache Commons Compress
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in Oracle Essbase
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Utilities Network Management System
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Primavera P6 Enterprise Project Portfolio Management
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Apache Creadur Rat update for Apache Commons Compress
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in Oracle Life Sciences Empirica Signal
• Multiple vulnerabilities in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Transportation Management
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM User Entity Behavior Analytics