CVE-2019-12402

Name	CVE-2019-12402
Description	The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	939610

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcommons-compress-java (PTS)	bullseye	1.20-1	fixed
	bookworm	1.22-1	fixed
	sid, trixie	1.27.1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
libcommons-compress-java	source	jessie	(not affected)
libcommons-compress-java	source	stretch	(not affected)
libcommons-compress-java	source	buster	1.18-2+deb10u1
libcommons-compress-java	source	(unstable)	1.18-3	low	939610

Notes

[stretch] - libcommons-compress-java <not-affected> (Vulnerable code introduced later)
[jessie] - libcommons-compress-java <not-affected> (Vulnerable code introduced later)
https://www.openwall.com/lists/oss-security/2019/08/27/1
Fixed in upstream commit: https://gitbox.apache.org/repos/asf?p=commons-compress.git;a=commitdiff;h=4ad5d80a6272e007f64a6ac66829ca189a8093b9;hp=16a0c84e84b93cc8c107b7ff3080bd11317ab581