CVE-2019-12402: apache software foundation apache commons compress Infinite Loop
CVSS: 7.5v3.1HighModified
AliasesMGASA-2020-0001UBUNTU-CVE-2019-12402DEBIAN-CVE-2019-12402CGA-27jf-7f4q-jg67CGA-2hjq-hjxc-vv9cCGA-2wcc-948c-qxv7CGA-5269-h463-8r7wCGA-6f62-99cj-mv2fCGA-6m45-p35v-68w8CGA-7p7m-9hc3-hc4gCGA-83gv-2r6v-g45jCGA-8v8w-x7j8-7qhvCGA-9qgx-rwvq-hm58CGA-c5xm-v2rh-vqmfCGA-c725-gjcf-4vp9CGA-cg6r-9xj3-9gvhCGA-f3xp-g9m2-xcfvCGA-f6gx-3p28-hwrgCGA-f6wv-9g8r-8hx7CGA-g7gp-7r58-859rCGA-g9rm-wvwx-f7c6CGA-gcqq-4rg5-fm9gCGA-grxh-6wxj-mpc2CGA-h93r-fxc9-r4gpCGA-hrx4-fg8x-mqfpCGA-j4m6-95mh-mx66CGA-p858-rpx3-g34cCGA-p88w-74pg-2f6jCGA-ph96-p5fg-fqhpGHSA-53x6-4x5p-rrvvCGA-qc27-5xgr-jrrjCGA-qj2w-jcg5-ww95CGA-rh7p-rmv4-2hh8CGA-whv7-r848-xg8xCGA-wvvr-6j73-q2q6CGA-x3cr-36h3-99mvCGA-x8gf-qg76-h2q7CGA-x9h3-q9cc-8cqv
Published 29-08-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-12402 is a high (CVSS 7.5) Infinite Loop vulnerability in apache software foundation apache commons compress. EPSS estimates a 16.16% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
16.16%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 29-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
CVSS metrics
6 scores · 5 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
16.16%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 16.16% on 18-09-2026
18-09-202618-10-2026
EPSS score16.16%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- eco-java-gradle-5.0All versions (No fix recorded)
- eco-java-gradle-5.1All versions (No fix recorded)
- eco-java-gradle-5.1.1All versions (No fix recorded)
- eco-java-gradle-5.2All versions (No fix recorded)
- eco-java-gradle-5.2.1All versions (No fix recorded)
Oracle17 products
- banking_payments≥ 14.1.0, ≤ 14.4.0
- banking_platform2.6.2 | 2.7.0 | 2.8.0 | 2.9.0
- communications_element_manager≥ 8.2.0, ≤ 8.2.2
- communications_ip_service_activator7.3.0 | 7.4.0
- communications_session_report_manager≥ 8.2.0, ≤ 8.2.2
Apache1 product
- commons_compress≥ 1.15, ≤ 1.18
Apache software foundation1 product
- apache commons compress1.15 to 1.18
Debian1 product
- libcommons-compress-java< 1.18-3
Fedoraproject1 product
- fedoraEOL30 | 31
Io.github.1tchy.java9modular.org.apache.commons1 product
- commons-compress1.18.1
Mageia1 product
- apache-commons-compress< 1.19-1.mga7
Org.apache.commons1 product
- commons-compress≥ 1.15, < 1.19
Ubuntu1 product
- libcommons-compress-javaAll versions (No fix recorded)
10 vendors · 42 products
