Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

Vulnerability

When reading a specially crafted 7Z archive, the SevenZFile class in Apache Commons Compress versions 1.6 through 1.20 can be made to allocate large amounts of memory, resulting in an out-of-memory error even for very small inputs [1]. The issue is tracked as COMPRESS-542 [2]. The vulnerability is present in the sevenz package.

Exploitation

An attacker needs to provide a malicious 7Z archive to a service that uses the SevenZFile class. No authentication or special privileges are required; the attacker only needs to supply the crafted archive. Starting with Compress 1.19, a feature to recover broken 7z archives was introduced, which makes exploitation far easier because the recovery code triggers the excessive memory allocation [2]. The attacker does not need to interact further after the archive is processed.

Impact

Successful exploitation leads to a denial of service (DoS) condition. The service consuming the archive will exhaust available memory and crash or become unresponsive. The impact is limited to availability; no data confidentiality or integrity is compromised.

Mitigation

Users should upgrade to Apache Commons Compress 1.21 or later, which contains the fix [2]. For users unable to upgrade, the recovery feature introduced in 1.19 can be disabled by not enabling it explicitly. Additionally, users can control the amount of memory SevenZFile may use via configuration options [2]. No workaround is available for versions prior to 1.19.