CVE-2012-2098

Related Files

Apache Commons Compress / Apache Ant Denial Of Service

Posted May 24, 2012

Authored by David Jorm

Apache Commons Compress versions 1.0 through 1.4 and Apache Ant versions 1.5 through 1.8.3 suffer from a denial of service vulnerability. The bzip2 compressing streams in Apache Commons Compress and Apache Ant internally use sorting algorithms with unacceptable worst-case performance on very repetitive inputs. A specially crafted input to Compress' BZip2CompressorOutputStream or Ant's <bzip2> task can be used to make the process spend a very long time while using up all available processing time effectively leading to a denial of service.

tags | advisory, denial of service

advisories | CVE-2012-2098

SHA-256 | 764b4680811098ad5654daa7aacc0274f9de6ab81bef5b8286b792367f7e802c

Download | Favorite | View