Vulnerability Name:

CVE-2018-11771 (CCN-148429)

Assigned:2018-08-16
Published:2018-08-16
Updated:2022-04-18
Summary:When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
3.1 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.7 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
2.1 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-835
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-11771

Source: CCN
Type: Apache Web site
Commons Compress

Source: CCN
Type: oss-sec Mailing List, Thu, 16 Aug 2018 14:37:40 +0200
[CVE-2018-11771] Apache Commons Compress 1.7 to 1.17 denial of service vulnerability

Source: CCN
Type: IBM Security Bulletin 739173 (Network Performance Insight)
IBM Network Performance Insight (CVE-2018-11771)

Source: CCN
Type: IBM Security Bulletin 883280 (Cloud App Management)
A vulnerability in Apache Commons Compress may affect IBM Cloud App Management V2018

Source: BID
Type: Broken Link
105139

Source: CCN
Type: BID-105139
Apache Commons Compress CVE-2018-11771 Denial of Service Vulnerability

Source: SECTRACK
Type: Broken Link
1041503

Source: XF
Type: UNKNOWN
apache-commons-cve201811771-dos(148429)

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-dev] 20190930 [GitHub] [tinkerpop] spmallette closed pull request #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-commits] 20190930 [GitHub] [tinkerpop] spmallette merged pull request #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-commits] 20190923 [GitHub] [tinkerpop] robertdale commented on issue #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-dev] 20190924 [GitHub] [tinkerpop] spmallette commented on issue #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-commits] 20190924 [GitHub] [tinkerpop] spmallette commented on issue #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[announce] 20180816 [CVE-2018-11771] Apache Commons Compress 1.7 to 1.17 denial of service vulnerability

Source: MLIST
Type: Mailing List, Vendor Advisory
[creadur-dev] 20190530 [Discuss] RAT-244 - update to language level 1.7 due to CVE issues in RAT

Source: MLIST
Type: Mailing List, Vendor Advisory
[commons-notifications] 20190827 svn commit: r1049290 - in /websites/production/commons/content/proper/commons-compress: changes-report.html security-reports.html

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-commits] 20190924 [GitHub] [tinkerpop] justinchuch commented on issue #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-commits] 20190923 [GitHub] [tinkerpop] spmallette commented on issue #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-dev] 20190924 [GitHub] [tinkerpop] justinchuch commented on issue #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[commons-commits] 20190827 [commons-compress] branch master updated: record CVE-2019-12402

Source: MLIST
Type: Mailing List, Vendor Advisory
[tinkerpop-commits] 20190923 [GitHub] [tinkerpop] justinchuch opened a new pull request #1199: Upgrade commons-compress to version 1.19 due to CVE-2018-11771

Source: MLIST
Type: Mailing List, Vendor Advisory
[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1

Source: CCN
Type: IBM Security Bulletin 6198380 (DB2 for Linux- UNIX and Windows)
Multiple vulnerabilities in dependent libraries affect IBM Db2 leading to denial of service or privilege escalation.

Source: CCN
Type: IBM Security Bulletin 6210366 (Monitoring)
Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product

Source: CCN
Type: IBM Security Bulletin 6244618 (Cloud Pak System)
Multiple vulnerabilities in Open Source used in IBM Cloud Pak System

Source: CCN
Type: IBM Security Bulletin 6356539 (Planning Analytics Local)
Multiple vulnerabilities affect IBM Planning Analytics

Source: CCN
Type: IBM Security Bulletin 6444895 (Db2 Warehouse)
IBM Db2 Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2

Source: CCN
Type: IBM Security Bulletin 6451705 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6570915 (Data Risk Manager)
IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)

Source: CCN
Type: IBM Security Bulletin 6605881 (PureData System for Operational Analytics)
Multiple security vulnerabilities have been identified in IBM DB2 shipped with IBM PureData System for Operational Analytics

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apache:commons-compress:*:*:*:*:*:*:*:* (Version >= 1.7.0 and <= 1.17.0)

    • Configuration 2:
  • cpe:/a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apache:commons_compress:1.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:commons_compress:1.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:commons_compress:1.7:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:db2:11.1:*:*:*:*:linux:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:unix:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:windows:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:monitoring:8.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:linux:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:unix:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:windows:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:linux:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:unix:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:windows:*:*
  • OR cpe:/a:ibm:cloud_pak_system:2.3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_system:2.3.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:linux:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:unix:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:windows:*:*
  • OR cpe:/a:ibm:planning_analytics_local:2.0.9.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.disco:def:2018117710000000
    V
    		CVE-2018-11771 on Ubuntu 19.04 (disco) - low.
    2018-08-16
    oval:com.ubuntu.bionic:def:201811771000
    V
    		CVE-2018-11771 on Ubuntu 18.04 LTS (bionic) - low.
    2018-08-16
    oval:com.ubuntu.cosmic:def:2018117710000000
    V
    		CVE-2018-11771 on Ubuntu 18.10 (cosmic) - low.
    2018-08-16
    oval:com.ubuntu.cosmic:def:201811771000
    V
    		CVE-2018-11771 on Ubuntu 18.10 (cosmic) - low.
    2018-08-16
    oval:com.ubuntu.bionic:def:2018117710000000
    V
    		CVE-2018-11771 on Ubuntu 18.04 LTS (bionic) - low.
    2018-08-16
    oval:com.ubuntu.trusty:def:201811771000
    V
    		CVE-2018-11771 on Ubuntu 14.04 LTS (trusty) - low.
    2018-08-16
    oval:com.ubuntu.xenial:def:2018117710000000
    V
    		CVE-2018-11771 on Ubuntu 16.04 LTS (xenial) - low.
    2018-08-16
    oval:com.ubuntu.xenial:def:201811771000
    V
    		CVE-2018-11771 on Ubuntu 16.04 LTS (xenial) - low.
    2018-08-16
    BACK
    apache commons-compress *
    oracle weblogic server 14.1.1.0.0
    apache commons compress 1.11
    apache commons compress 1.15
    apache commons compress 1.7
    ibm db2 11.1
    ibm db2 11.1
    ibm db2 11.1
    ibm cognos analytics 11.0
    ibm monitoring 8.1.4
    ibm cognos analytics 11.1
    ibm db2 11.1
    ibm db2 11.1
    ibm db2 11.1
    ibm db2 11.5
    ibm db2 11.5
    ibm db2 11.5
    ibm cloud pak system 2.3.0.1
    ibm cloud pak system 2.3.1.1
    ibm db2 11.5
    ibm db2 11.5
    ibm db2 11.5
    ibm planning analytics local 2.0.9.2