{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-42503", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-09-11T11:59:40.623Z", "datePublished": "2023-09-14T07:45:14.520Z", "dateUpdated": "2024-08-02T19:23:39.663Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2/", "defaultStatus": "unaffected", "packageName": "org.apache.commons:commons-compress", "product": "Apache Commons Compress", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.24.0", "status": "affected", "version": "1.22", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Yakov Shafranovich, Amazon Web Services"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.<p>This issue affects Apache Commons Compress:&nbsp;from 1.22 before 1.24.0.</p><p>Users are recommended to upgrade to version 1.24.0, which fixes the issue.</p><span style=\"background-color: rgb(255, 255, 255);\">A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.</span><br><br><span style=\"background-color: rgb(255, 255, 255);\">In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example \u201c1647221103.5998539\u201d). The impacted fields are \u201catime\u201d, \u201cctime\u201d, \u201cmtime\u201d and \u201cLIBARCHIVE.creationtime\u201d. No input validation is performed prior to the parsing of header values.</span><br><br><span style=\"background-color: rgb(255, 255, 255);\">Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as \u201c9e9999999\u201d) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].</span><br><br><span style=\"background-color: rgb(255, 255, 255);\">[1]: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://issues.apache.org/jira/browse/COMPRESS-612\">https://issues.apache.org/jira/browse/COMPRESS-612</a><br><span style=\"background-color: rgb(255, 255, 255);\">[2]: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05\">https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05</a><br><span style=\"background-color: rgb(255, 255, 255);\">[3]: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html\">https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html</a><br><span style=\"background-color: rgb(255, 255, 255);\">[4]: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://bugs.openjdk.org/browse/JDK-6560193\">https://bugs.openjdk.org/browse/JDK-6560193</a><br><span style=\"background-color: rgb(255, 255, 255);\">[5]: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098\">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098</a><br><br><span style=\"background-color: rgb(255, 255, 255);\">Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.</span><br><br>"}], "value": "Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress:\u00a0from 1.22 before 1.24.0.\n\nUsers are recommended to upgrade to version 1.24.0, which fixes the issue.\n\nA third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.\n\nIn version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example \u201c1647221103.5998539\u201d). The impacted fields are \u201catime\u201d, \u201cctime\u201d, \u201cmtime\u201d and \u201cLIBARCHIVE.creationtime\u201d. No input validation is performed prior to the parsing of header values.\n\nParsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as \u201c9e9999999\u201d) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].\n\n[1]: https://issues.apache.org/jira/browse/COMPRESS-612 \n[2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 \n[3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html \n[4]: https://bugs.openjdk.org/browse/JDK-6560193 \n[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 \n\nOnly applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.\n\n"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2023-09-14T07:45:14.520Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c"}, {"url": "https://security.netapp.com/advisory/ntap-20231020-0003/"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:39.663Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c"}, {"url": "https://security.netapp.com/advisory/ntap-20231020-0003/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:*", "matchCriteriaId": "F05475BE-7994-4CCC-A70C-FCBE832D886A", "versionEndExcluding": "1.24.0", "versionStartIncluding": "1.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress:\u00a0from 1.22 before 1.24.0.\n\nUsers are recommended to upgrade to version 1.24.0, which fixes the issue.\n\nA third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.\n\nIn version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example \u201c1647221103.5998539\u201d). The impacted fields are \u201catime\u201d, \u201cctime\u201d, \u201cmtime\u201d and \u201cLIBARCHIVE.creationtime\u201d. No input validation is performed prior to the parsing of header values.\n\nParsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as \u201c9e9999999\u201d) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].\n\n[1]: https://issues.apache.org/jira/browse/COMPRESS-612 \n[2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 \n[3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html \n[4]: https://bugs.openjdk.org/browse/JDK-6560193 \n[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 \n\nOnly applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.\n\n"}, {"lang": "es", "value": "\"Vulnerabilidad de Validaci\u00f3n de Entrada Incorrecta, Consumo de Recursos Incontrolado en Apache Commons Compress en el an\u00e1lisis TAR. Este problema afecta a Apache Commons Compress: desde 1.22 antes de 1.24.0. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.24.0, que soluciona el problema. Un tercero puede crear un archivo TAR malformado manipulando los encabezados de los tiempos de modificaci\u00f3n del archivo, que cuando se analizan con Apache Commons Compress, causar\u00e1n un problema de denegaci\u00f3n de servicio debido al consumo de CPU. En la versi\u00f3n 1.22 de Apache Commons Compress, se soportan tiempos de modificaci\u00f3n de archivos con mayor precisi\u00f3n (problema # COMPRESS-612 [1]). El formato de los encabezados extendidos de PAX que contienen estos datos consta de dos n\u00fameros separados por un punto [2], que indica segundos y precisi\u00f3n de subsegundos (por ejemplo, \u201c1647221103.5998539\u201d). Los campos afectados son \"\"atime\"\", \"\"ctime\"\", \"\"mtime\"\" y \"\"LIBARCHIVE.creationtime\"\". No se realiza ninguna validaci\u00f3n de entrada antes del an\u00e1lisis de los valores del encabezado. El an\u00e1lisis de estos n\u00fameros utiliza la clase BigDecimal [3] del JDK, que tiene un problema de complejidad algor\u00edtmica conocido p\u00fablicamente al realizar operaciones con n\u00fameros grandes, lo que provoca denegaci\u00f3n de servicio (consulte el problema # JDK-6560193 [4]). Un tercero puede manipular los encabezados de tiempo de un archivo TAR colocando un n\u00famero con una fracci\u00f3n muy larga (300.000 d\u00edgitos) o un n\u00famero con notaci\u00f3n de exponente (como \"\"9e9999999\"\") dentro de un encabezado de tiempo de modificaci\u00f3n del archivo y el an\u00e1lisis de los archivos. con estos encabezados llevar\u00e1 horas en lugar de segundos, lo que provocar\u00e1 una denegaci\u00f3n de servicio por agotamiento de los recursos de la CPU. Este problema es similar a CVE-2012-2098 [5]. \n[1]: https://issues.apache.org/jira/browse/COMPRESS-612 \n[2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 \n[3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html \n[4]: ??https://bugs.openjdk.org/browse/JDK-6560193 \n[5]: https: //cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098\nSolo se ven afectadas las aplicaciones que utilizan la clase CompressorStreamFactory (con detecci\u00f3n autom\u00e1tica de tipos de archivos), TarArchiveInputStream y TarFile para analizar archivos TAR. Dado que este c\u00f3digo se introdujo en la versi\u00f3n 1.22, solo esa versi\u00f3n y las versiones posteriores se ven afectadas.\""}], "id": "CVE-2023-42503", "lastModified": "2024-11-21T08:22:41.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-14T08:15:08.057", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Mailing List", "URL Repurposed"], "url": "https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20231020-0003/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mailing List", "URL Repurposed"], "url": "https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20231020-0003/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "apache-commons-compress: Denial of service via CPU consumption for malformed TAR file", "id": "2295031", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295031"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress:\u00a0from 1.22 before 1.24.0.\nUsers are recommended to upgrade to version 1.24.0, which fixes the issue.\nA third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.\nIn version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example \u201c1647221103.5998539\u201d). The impacted fields are \u201catime\u201d, \u201cctime\u201d, \u201cmtime\u201d and \u201cLIBARCHIVE.creationtime\u201d. No input validation is performed prior to the parsing of header values.\nParsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as \u201c9e9999999\u201d) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].\n[1]: https://issues.apache.org/jira/browse/COMPRESS-612 \n[2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 \n[3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html \n[4]: https://bugs.openjdk.org/browse/JDK-6560193 \n[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 \nOnly applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.", "A flaw was found in Apache Commons Compress, where it would permit the creation of a malformed TAR file by manipulating file modification time headers. This issue can lead to excessive CPU consumption and a denial of service, affecting the availability."], "name": "CVE-2023-42503", "package_state": [{"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Not affected", "package_name": "commons-compress", "product_name": "Red Hat build of Apache Camel for Quarkus"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Not affected", "package_name": "commons-compress", "product_name": "Red Hat build of Apicurio Registry"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "commons-compress", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:optaplanner:::el6", "fix_state": "Not affected", "package_name": "commons-compress", "product_name": "Red Hat build of OptaPlanner 8"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "commons-compress", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "commons-compress", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "impact": "moderate", "package_name": "commons-compress", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "commons-compress", "product_name": "Red Hat Integration Camel K"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Out of support scope", "package_name": "commons-compress", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Out of support scope", "package_name": "commons-compress", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2023-09-02T10:10:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-42503\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-42503\nhttps://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c"], "threat_severity": "Moderate"}