CVE-2019-12402

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-12402
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-12402.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-12402
Aliases
Downstream
Related
Published
2019-08-30T09:15:17.910Z
Modified
2026-05-18T05:50:36.611742255Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "30"
                },
                {
                    "last_affected": "31"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "fedoraproject:fedora",
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "14.1.0"
                },
                {
                    "last_affected": "14.4.0"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:banking_payments",
            "cpes": [
                "cpe:2.3:a:oracle:banking_payments:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "2.6.2"
                },
                {
                    "last_affected": "2.7.0"
                },
                {
                    "last_affected": "2.8.0"
                },
                {
                    "last_affected": "2.9.0"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:banking_platform"
        },
        {
            "extracted_events": [
                {
                    "introduced": "8.2.0"
                },
                {
                    "last_affected": "8.2.2"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:communications_element_manager",
            "cpes": [
                "cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "7.3.0"
                },
                {
                    "last_affected": "7.4.0"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:communications_ip_service_activator",
            "cpes": [
                "cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "8.2.0"
                },
                {
                    "last_affected": "8.2.2"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:communications_session_report_manager",
            "cpes": [
                "cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "8.2.0"
                },
                {
                    "last_affected": "8.2.2"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:communications_session_route_manager",
            "cpes": [
                "cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "18.0"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:customer_management_and_segmentation_foundation",
            "cpes": [
                "cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "21.2"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:essbase",
            "cpes": [
                "cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "12.1.0"
                },
                {
                    "last_affected": "12.3.0"
                },
                {
                    "last_affected": "12.4.0"
                },
                {
                    "last_affected": "14.0.0"
                },
                {
                    "last_affected": "14.1.0"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:flexcube_investor_servicing"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "12.0.0"
                },
                {
                    "last_affected": "12.1.0"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:flexcube_private_banking"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "11.1.2.4"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:hyperion_infrastructure_technology",
            "cpes": [
                "cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "12.2.1.4.0"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:jdeveloper"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.56"
                },
                {
                    "last_affected": "8.57"
                },
                {
                    "last_affected": "8.58"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:peoplesoft_enterprise_pt_peopletools"
        },
        {
            "extracted_events": [
                {
                    "introduced": "18.8.0"
                },
                {
                    "last_affected": "18.8.8"
                },
                {
                    "last_affected": "19.12.0"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:primavera_gateway",
            "cpes": [
                "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "15.0"
                },
                {
                    "last_affected": "16.0"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:retail_integration_bus",
            "cpes": [
                "cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "last_affected": "15.0"
                },
                {
                    "last_affected": "16.0"
                },
                {
                    "last_affected": "17.0"
                },
                {
                    "last_affected": "18.0"
                },
                {
                    "last_affected": "19.0"
                }
            ],
            "vendor_product": "oracle:retail_xstore_point_of_service",
            "cpes": [
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "12.2.1.3.0"
                },
                {
                    "last_affected": "12.2.1.4.0"
                }
            ],
            "source": "CPE_FIELD",
            "vendor_product": "oracle:webcenter_portal",
            "cpes": [
                "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/commons-compress

Affected ranges

Type
GIT
Repo
https://github.com/apache/commons-compress
Events
Introduced
01b06d5ef5c5ac3bd651bedcfec7433231cea371
Last affected
b95d5cde4c68640f886e3c6802384fae47408a37
Database specific 
{
    "cpe": "cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.15"
        },
        {
            "last_affected": "1.18"
        }
    ],
    "source": "CPE_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-12402.json"