CVE-2018-11771

Vulnerability

In Apache Commons Compress versions 1.7 through 1.17, the ZipArchiveInputStream.read() method does not correctly return an end-of-file (EOF) indication when the end of a specially crafted ZIP archive has been reached. This flaw manifests when the method is used in combination with a java.io.InputStreamReader, which can then treat the stream as infinite and continue reading indefinitely [1].

Exploitation

An attacker must supply a maliciously crafted ZIP archive to a service or application that uses the affected ZipArchiveInputStream from Apache Commons Compress. The attack does not require authentication if the service accepts arbitrary ZIP files. Once the archive is parsed, the InputStreamReader will not detect the end of the stream, causing the reading process to loop infinitely without termination [1].

Impact

Successful exploitation results in a denial of service (DoS) condition. The infinite stream consumes CPU resources and can block the thread performing the read operation, potentially making the targeted service unresponsive or causing resource exhaustion on the host system [1].

Mitigation

The vulnerability is fixed in Apache Commons Compress version 1.18, released on 2018-08-09. All users should upgrade to this version or later to eliminate the vulnerability. No known workarounds exist for earlier versions. There is no indication that this issue has been exploited in the wild or added to the CISA Known Exploited Vulnerabilities catalog [1][2].