Skip to content
This repository has been archived by the owner on Jul 28, 2023. It is now read-only.

GitSecure Vulnerability Report #4

Open
ralanlittle opened this issue Aug 27, 2020 · 0 comments
Open

GitSecure Vulnerability Report #4

ralanlittle opened this issue Aug 27, 2020 · 0 comments

Comments

@ralanlittle
Copy link

GitSecure Vulnerablility Report

Vulnerabilities discovered in the following manifest file(s)

Manifest File: pom.xml

Package Name: org.apache.commons:commons-compress Version : 1.18

Vulnerabilities
 CVE ID: GHSA-53x6-4x5p-rrvv
 Severity:  High
 Fixed in Version:  1.19
 Description:  The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

 CVE ID: CVE-2019-12402
 Severity:  High
 Fixed in Version:  1.19
 Description:  The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant