CVE-2018-11771

Description

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17s ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress zip package.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

1.296

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities are affected in Oracle WebLogic Server 14.1.1.0.0	Windows
Vulnerabilities CVE-2018-11771 are fixed in Apache-commons-compress 1.18	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.0	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1	Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.0.9.2	Windows
Vulnerabilities CVE-2018-11771 are fixed in Apache-commons-compress for Linux 1.18	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234