Candidate: CVE-2018-11771
PublicDate: 2018-08-16 15:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11771
 http://www.openwall.com/lists/oss-security/2018/08/16/2
 http://www.securitytracker.com/id/1041503
 https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330@%3Cannounce.apache.org%3E
Description:
 When reading a specially crafted ZIP archive, the read method of Apache
 Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the
 correct EOF indication after the end of the stream has been reached. When
 combined with a java.io.InputStreamReader this can lead to an infinite
 stream, which can be used to mount a denial of service attack against
 services that use Compress' zip package.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906301
 https://issues.apache.org/jira/browse/COMPRESS-463
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [5.5 MEDIUM]
 nvd: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [5.5 MEDIUM]


Patches_libcommons-compress-java:
 other: https://github.com/apache/commons-compress/commit/a41ce689
 other: https://github.com/apache/commons-compress/commit/0fe6ae31
 other: https://github.com/apache/commons-compress/commit/64ed6dde
upstream_libcommons-compress-java: needs-triage
precise/esm_libcommons-compress-java: DNE
trusty_libcommons-compress-java: ignored (reached end-of-life)
trusty/esm_libcommons-compress-java: DNE (trusty was needs-triage)
xenial_libcommons-compress-java: ignored (end of standard support, was needed)
bionic_libcommons-compress-java: needed
cosmic_libcommons-compress-java: released (1.18-1)
disco_libcommons-compress-java: released (1.18-1)
eoan_libcommons-compress-java: released (1.18-1)
focal_libcommons-compress-java: released (1.18-1)
groovy_libcommons-compress-java: released (1.18-1)
hirsute_libcommons-compress-java: released (1.18-1)
impish_libcommons-compress-java: released (1.18-1)
jammy_libcommons-compress-java: released (1.18-1)
devel_libcommons-compress-java: released (1.18-1)