Infinite loop in Apache Commons Compress - CVE-2024-25710

 

Infinite loop in Apache Commons Compress - CVE-2024-25710

Published: February 20, 2024


Vulnerability identifier: #VU86624
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-25710
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing a corrupt DUMP file. A remote attacker can consume all available system resources and cause denial of service conditions.


Affected software

Apache Commons Compress
Amazon Linux AMI
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Server Module
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
Anolis OS
Cloud Pak for Security (CP4S)
Oracle Analytics Desktop
IBM Qradar SIEM
JBoss Data Grid
IBM Cognos Controller
IBM License Metric Tool
IBM Cognos Command Center
Event Streams
IBM Integrated Analytics System
Oracle Business Process Management Suite
Astronomer with IBM
Cloud Pak for Network Automation
Tivoli Network Manager IP Edition
Db2 Big SQL
IBM OpenPages with Watson
IBM Business Automation Manager Open Editions
Datacap
Oracle Data Integrator
IBM Application Suite - IBM Asset Data Dictionary Component
Event Processing
IBM Planning Analytics Workspace
Storage Copy Data Management
PowerStore T
Suite License Service
TPF Toolkit
User Entity Behavior Analytics
Cognos Dashboards on Cloud Pak for Data
Engineering Lifecycle Management - Jazz Foundation
Storage Protect Server
Storage Virtualize
Maximo Application Suite - Monitor Component
Storage Protect Plus Server
IBM Event Endpoint Management
Business Automation Insights
Storage Insights - Data Collector
IBM Cloud Pak for Data System
Migration Toolkit for Runtimes
IBM Process Mining
IBM Cloud Transformation Advisor
Red Hat build of Quarkus
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Control Center
Confluence Data Center
IBM Tivoli Netcool/OMNIbus WebGUI
WebSphere Remote Server
Bamboo Server
IBM Security Verify Governance
InfoSphere Master Data Management
IBM Observability with Instana
IBM Operator for Apache Flink
Log Analysis
Red Hat Integration - Service Registry
IBM Fusion HCI
Red Hat Integration Camel Extensions for Quarkus
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Object Storage Systems
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Spectrum Control
Dell Secure Connect Gateway
IBM Tivoli Business Service Manager
Red Hat Migration Toolkit for Applications
UCD - IBM UrbanCode Deploy
IBM Tivoli Netcool Impact
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
Bitbucket Data Center
IBM Common Licensing
IBM Workload Scheduler
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
Voice Gateway
QRadar Suite
Splunk Enterprise
DataEase
Oracle JDeveloper
IBM App Connect Enterprise
Confluence Server
JD Edwards EnterpriseOne Tools
IBM i Access Client Solutions
IBM Disconnected Log Collector
IBM DB2
Oracle Communications Cloud Native Core Unified Data Repository
Import tests from maven
sbt-bootstrap
sbt
maven-resolver-impl
maven-resolver-transport-file
maven-resolver-connector-basic
maven-resolver-javadoc
maven-resolver-transport-classpath
maven-resolver-transport-wagon
maven-resolver
maven-resolver-transport-http
maven-resolver-test-util
maven-resolver-api
maven-resolver-named-locks
maven-resolver-spi
maven-resolver-util
maven-doxia-sitetools-javadoc
maven-doxia-sitetools
maven-doxia-module-xdoc
maven-doxia-module-confluence
maven-doxia-core
maven-doxia-module-apt
maven-doxia-module-latex
maven-doxia-module-twiki
maven-doxia-module-rtf
maven-doxia-module-docbook-simple
maven-doxia-test-docs
maven-doxia-sink-api
maven-doxia-logging-api
maven-doxia-javadoc
maven-doxia-module-fo
maven-doxia-module-xhtml5
maven-doxia-module-xhtml
maven-doxia-module-fml
apache-commons-codec-javadoc
apache-commons-codec
apache-commons-compress
apache-commons-compress-javadoc
apache-commons-configuration2
apache-commons-configuration2-javadoc
apache-commons-io-javadoc
apache-commons-io
maven-reporting-api-javadoc
maven-reporting-api
maven-reporting-impl
maven-reporting-impl-javadoc
maven-jar-plugin-javadoc
maven-jar-plugin-bootstrap
maven-jar-plugin
maven-resources-plugin
maven-resources-plugin-javadoc
maven-resources-plugin-bootstrap
maven-assembly-plugin
maven-assembly-plugin-javadoc
maven-javadoc-plugin-bootstrap
maven-javadoc-plugin-javadoc
maven-javadoc-plugin
maven-javadoc
maven
maven-lib
xmvn-connector
xmvn-resolve
xmvn-mojo
xmvn-core
xmvn-install
xmvn-subst
xmvn-minimal
xmvn
xmvn-mojo-javadoc
xmvn-tools-javadoc
xmvn-connector-javadoc
xmvn-parent
xmvn-api
gradle-local
maven-local
ivy-local
Red Hat OpenShift Serverless
watsonx.data
IBM Cloud Pak System
AMQ Streams
AMQ Broker
Bitbucket Server
IBM Content Navigator
Operational Decision Manager

How to mitigate CVE-2024-25710

Install updates from vendor's website.

Apache Commons Compress - update to 1.26.0
IBM Integrated Analytics System - update to 1.0.31.0
Astronomer with IBM - update to 1.0.1
IBM Cloud Pak for Data System - update to 1.0.9.0
Voice Gateway - update to 1.0.8.19
Migration Toolkit for Runtimes - update to 1.2.5
QRadar Suite - update to 1.10.20.0
IBM Process Mining - update to 1.15.0
DataEase - update to 2.7.0
IBM Cloud Transformation Advisor - addressed in versions 3.9.0, 3.10.2
Cloud Pak for Network Automation - update to 2.7.1
Red Hat build of Quarkus - addressed in versions 2.13.9.SP2, 3.2.11
Tivoli Network Manager IP Edition - update to 4.2.0.20
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Sterling Control Center - addressed in versions 6.2.1.0.15, 6.3.1.0.3
Db2 Big SQL - update to 7.6.8
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
Confluence Data Center - addressed in versions 7.19.25, 8.5.12, 8.9.4
Confluence Server - addressed in versions 7.19.25, 8.5.12, 8.9.4
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.34
JBoss Data Grid - update to 8.4.7
IBM Business Automation Manager Open Editions - update to 9.1.1
Bamboo Server - addressed in versions 9.2.12, 9.4.4, 9.5.2
Splunk Enterprise - addressed in versions 9.1.7, 9.2.4, 9.3.2
IBM Cognos Controller - update to 11.0.1.0.3
IBM Observability with Instana - update to 274
Import tests from maven - update to site-plugin
sbt-bootstrap - update to 0.13.18-150200.4.19.7
sbt - update to 0.13.18-150200.4.19.7
IBM Operator for Apache Flink - update to 1.1.3
IBM i Access Client Solutions - update to 1.1.9.5
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
Event Processing - update to 1.2.1
Log Analysis - update to 1.3.8.1 IF001
IBM Disconnected Log Collector - update to 1.8.6
maven-resolver-impl - update to 1.9.18-150200.3.17.2
maven-resolver-transport-file - update to 1.9.18-150200.3.17.2
maven-resolver-connector-basic - update to 1.9.18-150200.3.17.2
maven-resolver-javadoc - update to 1.9.18-150200.3.17.2
maven-resolver-transport-classpath - update to 1.9.18-150200.3.17.2
maven-resolver-transport-wagon - update to 1.9.18-150200.3.17.2
maven-resolver - update to 1.9.18-150200.3.17.2
maven-resolver-transport-http - update to 1.9.18-150200.3.17.2
maven-resolver-test-util - update to 1.9.18-150200.3.17.2
maven-resolver-api - update to 1.9.18-150200.3.17.2
maven-resolver-named-locks - update to 1.9.18-150200.3.17.2
maven-resolver-spi - update to 1.9.18-150200.3.17.2
maven-resolver-util - update to 1.9.18-150200.3.17.2
maven-doxia-sitetools-javadoc - update to 1.11.1-150200.3.7.1
maven-doxia-sitetools - update to 1.11.1-150200.3.7.1
maven-doxia-module-xdoc - update to 1.12.0-150200.4.7.2
maven-doxia-module-confluence - update to 1.12.0-150200.4.7.2
maven-doxia-core - update to 1.12.0-150200.4.7.2
maven-doxia-module-apt - update to 1.12.0-150200.4.7.2
maven-doxia-module-latex - update to 1.12.0-150200.4.7.2
maven-doxia-module-twiki - update to 1.12.0-150200.4.7.2
maven-doxia-module-rtf - update to 1.12.0-150200.4.7.2
maven-doxia-module-docbook-simple - update to 1.12.0-150200.4.7.2
maven-doxia-test-docs - update to 1.12.0-150200.4.7.2
maven-doxia-sink-api - update to 1.12.0-150200.4.7.2
maven-doxia-logging-api - update to 1.12.0-150200.4.7.2
maven-doxia-javadoc - update to 1.12.0-150200.4.7.2
maven-doxia-module-fo - update to 1.12.0-150200.4.7.2
maven-doxia-module-xhtml5 - update to 1.12.0-150200.4.7.2
maven-doxia-module-xhtml - update to 1.12.0-150200.4.7.2
maven-doxia-module-fml - update to 1.12.0-150200.4.7.2
apache-commons-codec-javadoc - update to 1.16.1-150200.3.9.1
apache-commons-codec - update to 1.16.1-150200.3.9.1
apache-commons-compress - update to 1.21-4
apache-commons-compress - update to 1.25.0-1
apache-commons-compress-javadoc - update to 1.25.0-1
apache-commons-compress - update to 1.26.0-150200.3.16.1
apache-commons-compress-javadoc - update to 1.26.0-150200.3.16.1
Red Hat OpenShift Serverless - update to 1.33.0
IBM Planning Analytics Workspace - addressed in versions 2.0.95, 2.1.2
watsonx.data - update to 2.1
Storage Copy Data Management - update to 2.2.23.1
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
Red Hat Integration - Service Registry - update to 2.5.11
AMQ Streams - update to 2.7.0
IBM Fusion HCI - update to 2.8.0
apache-commons-configuration2 - update to 2.9.0-150200.5.5.1
apache-commons-configuration2-javadoc - update to 2.9.0-150200.5.5.1
Red Hat Integration Camel Extensions for Quarkus - addressed in versions 2.13.9.SP2, 3.2.11
apache-commons-io-javadoc - update to 2.15.1-150200.3.12.1
apache-commons-io - update to 2.15.1-150200.3.12.1
IBM Content Navigator - addressed in versions 3.0.11 IF016, 3.0.14 IF005, 3.0.15 IF002
maven-reporting-api-javadoc - update to 3.1.1-150200.3.7.1
maven-reporting-api - update to 3.1.1-150200.3.7.1
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.3
maven-reporting-impl - update to 3.2.0-150200.4.6.2
maven-reporting-impl-javadoc - update to 3.2.0-150200.4.6.2
maven-jar-plugin-javadoc - update to 3.3.0-150200.3.10.1
maven-jar-plugin-bootstrap - update to 3.3.0-150200.3.10.1
maven-jar-plugin - update to 3.3.0-150200.3.10.1
maven-resources-plugin - update to 3.3.1-150200.3.12.1
maven-resources-plugin-javadoc - update to 3.3.1-150200.3.12.1
maven-resources-plugin-bootstrap - update to 3.3.1-150200.3.12.1
maven-assembly-plugin - update to 3.6.0-150200.3.10.1
maven-assembly-plugin-javadoc - update to 3.6.0-150200.3.10.1
maven-javadoc-plugin-bootstrap - update to 3.6.0-150200.4.10.1
maven-javadoc-plugin-javadoc - update to 3.6.0-150200.4.10.1
maven-javadoc-plugin - update to 3.6.0-150200.4.10.1
PowerStore T - update to 3.6.1.4-2413340
Suite License Service - update to 3.9.0
maven-javadoc - update to 3.9.6-150200.4.21.2
maven - update to 3.9.6-150200.4.21.2
maven-lib - update to 3.9.6-150200.4.21.2
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.50, 3.18.2.45
xmvn-connector - update to 4.2.0-150200.3.18.1
xmvn-resolve - update to 4.2.0-150200.3.18.1
xmvn-mojo - update to 4.2.0-150200.3.18.1
xmvn-core - update to 4.2.0-150200.3.18.1
xmvn-install - update to 4.2.0-150200.3.18.1
xmvn-subst - update to 4.2.0-150200.3.18.1
xmvn-minimal - update to 4.2.0-150200.3.18.1
xmvn - update to 4.2.0-150200.3.18.1
xmvn-mojo-javadoc - update to 4.2.0-150200.3.18.1
xmvn-tools-javadoc - update to 4.2.0-150200.3.18.1
xmvn-connector-javadoc - update to 4.2.0-150200.3.18.1
xmvn-parent - update to 4.2.0-150200.3.18.1
xmvn-api - update to 4.2.0-150200.3.18.1
TPF Toolkit - update to 4.6 FP18
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.4
User Entity Behavior Analytics - update to 5.0.2
Cognos Dashboards on Cloud Pak for Data - update to 5.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.1
IBM Spectrum Control - update to 5.4.12
Dell Secure Connect Gateway - update to 5.24.00.14
IBM Tivoli Business Service Manager - update to 6.2.0.5.5
gradle-local - update to 6.2.0-150200.3.7.1
maven-local - update to 6.2.0-150200.3.7.1
ivy-local - update to 6.2.0-150200.3.7.1
Red Hat Migration Toolkit for Applications - update to 6.2.3
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.2 iFix033, 7.0.3 iFix013, 7.1.0 iFix003
UCD - IBM UrbanCode Deploy - addressed in versions 7.0.5.21, 7.1.2.17, 7.2.3.10, 7.3.2.5, 8.0.1.0
IBM Tivoli Netcool Impact - update to 7.1.0.33
IBM Maximo Asset Management - update to 7.6.1.3.22
AMQ Broker - update to 7.13.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.24
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.22
Storage Virtualize - addressed in versions 8.6.0.4, 8.7.0.0
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.16, 8.7.10, 9.0.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Maximo Application Suite - addressed in versions 8.10.18, 8.11.15, 9.0.3, 9.1.0
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 32, 8.11.1 Interim fix 25, 8.12.0.1 Interim fix 10
Bitbucket Server - update to 8.19.25
Bitbucket Data Center - update to 8.19.25
IBM Common Licensing - update to 9.0.0.1
IBM License Metric Tool - update to 9.2.35
IBM Workload Scheduler - addressed in versions 9.5.0.7, 10.1.0.5, 10.2.2
Storage Protect Plus Server - update to 10.1.16.3
IBM Cognos Command Center - update to 10.2.5 IF2
IBM App Connect Enterprise - addressed in versions 11.0.0.26, 12.0.12.2
IBM Event Endpoint Management - update to 11.2.1
Event Streams - update to 11.5.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF033, 23.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.31, 23.0.2.3
IBM Automation Decision Services - update to 23.0.2.0.3
Business Automation Insights - update to 23.0.2.0.3
Storage Insights - Data Collector - update to 20240412-0155

External References

Related Security Bulletins