What’s Vulnerable › Vulnerabilities
CVE-2019-12402
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 16.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-30 · updated 2026-06-17
- Weakness: CWE-835
Description
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Affected products
- Apache Software Foundation Apache Commons Compress: from 1.15 through 1.18
- Fedoraproject Fedora: 30, 31
- Oracle Corporation Banking Payments: from 14.1.0 through 14.4.0
- Oracle Banking Platform: 2.6.2, 2.7.0, 2.8.0, 2.9.0
- Oracle Communications Element Manager: from 8.2.0 through 8.2.2
- Oracle Communications Ip Service Activator: 7.3.0, 7.4.0
- Oracle Communications Session Report Manager: from 8.2.0 through 8.2.2
- Oracle Communications Session Route Manager: from 8.2.0 through 8.2.2
- Oracle Customer Management And Segmentation Foundation: 18.0
- Oracle Corporation Oracle Essbase: 21.2
- Oracle Corporation FLEXCUBE Investor Servicing: 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
- Oracle Corporation Oracle JDeveloper: 12.2.1.4.0
- Oracle Peoplesoft Enterprise Pt Peopletools: 8.56, 8.57, 8.58
- Oracle Corporation Primavera Gateway: from 18.8.0 through 18.8.8; 19.12.0
- Oracle Corporation Oracle Retail Integration Bus: 15.0, 16.0
- Oracle Corporation Retail Xstore Point of Service: 15.0, 16.0, 17.0, 18.0, 19.0
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
References
- https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E
- https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r5103b1c9242c0f812ac96e524344144402cbff9b6e078d1557bc7b1e%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r590c15cebee9b8e757e2f738127a9a71e48ede647a3044c504e050a4%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r5caf4fcb69d2749225391e61db7216282955204849ba94f83afe011f%40%3Cissues.flink.apache.org%3E
Get alerted when CVE-2019-12402 or the next vulnerability affects your stack