CVE-2024-25710

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.4 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/02/19/1	Mailing List Third Party Advisory
https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0010/
http://www.openwall.com/lists/oss-security/2024/02/19/1	Mailing List Third Party Advisory
https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0010/

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:*

History

13 Feb 2025, 18:17

Type	Values Removed	Values Added
Summary	(en) Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.	(en) Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Information

Published : 2024-02-19 09:15

Updated : 2025-02-13 18:17

NVD link : CVE-2024-25710

Mitre link : CVE-2024-25710

CVE.ORG link : CVE-2024-25710

JSON object : View

Products Affected

apache

commons_compress

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2024-25710", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-02-19T09:15:37.943", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/02/19/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://security.netapp.com/advisory/ntap-20240307-0010/", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/19/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240307-0010/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue."}, {"lang": "es", "value": "Bucle con vulnerabilidad de condici\u00f3n de salida inalcanzable (\"bucle infinito\") en Apache Commons Compress. Este problema afecta a Apache Commons Compress: desde 1.3 hasta 1.25.0. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.26.0, que soluciona el problema."}], "lastModified": "2025-02-13T18:17:15.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EF50821-2FCC-46EF-A55F-92BF58251310", "versionEndExcluding": "1.26.0", "versionStartIncluding": "1.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}