Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

Vulnerability

A denial of service vulnerability exists in the tar package of Apache Commons Compress versions 1.1 through 1.20. When reading a specially crafted TAR archive, the library can be made to allocate large amounts of memory, resulting in an out-of-memory error even for very small inputs [3]. The issue is triggered during the parsing of the archive's header or entry data, where insufficient validation allows an attacker to specify an extremely large size value that forces excessive memory allocation.

Exploitation

An attacker needs only the ability to supply a malicious TAR archive to a service or application that uses Apache Commons Compress's tar package. No authentication or special privileges are required. The attacker crafts a TAR file with manipulated metadata (e.g., a file entry with an inflated size field) that, when processed by the library, causes the allocation of a disproportionately large buffer. The service then exhausts available memory and crashes or becomes unresponsive.

Impact

Successful exploitation results in a denial of service (DoS) condition. The affected service or application becomes unavailable due to an out-of-memory error. There is no impact on confidentiality or integrity; the attack solely disrupts availability.

Mitigation

Users of Apache Commons Compress should upgrade to version 1.21 or later, which contains the fix for this vulnerability [3]. For Apache Ant users, which also uses the Compress library, upgrading to Ant 1.9.16 or 1.10.11 addresses the issue in that context [2]. No workarounds are available for earlier versions; upgrading is the recommended action.