7.5

CVE-2019-12402

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Commons Compress Version >= 1.15 <= 1.18
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31
Oracle ≫ Banking Payments Version >= 14.1.0 <= 14.4.0
Oracle ≫ Banking Platform Version2.6.2
Oracle ≫ Banking Platform Version2.7.0
Oracle ≫ Banking Platform Version2.8.0
Oracle ≫ Banking Platform Version2.9.0
Oracle ≫ Communications Element Manager Version >= 8.2.0 <= 8.2.2
Oracle ≫ Communications Session Report Manager Version >= 8.2.0 <= 8.2.2
Oracle ≫ Communications Session Route Manager Version >= 8.2.0 <= 8.2.2
Oracle ≫ Essbase Version21.2
Oracle ≫ Flexcube Private Banking Version12.0.0
Oracle ≫ Flexcube Private Banking Version12.1.0
Oracle ≫ Jdeveloper Version12.2.1.4.0
Oracle ≫ Primavera Gateway Version >= 18.8.0 <= 18.8.8
Oracle ≫ Primavera Gateway Version19.12.0
Oracle ≫ Retail Integration Bus Version15.0
Oracle ≫ Retail Integration Bus Version16.0
Oracle ≫ Webcenter Portal Version12.2.1.3.0
Oracle ≫ Webcenter Portal Version12.2.1.4.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.589
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory
Not Applicable