CVE Feed

    Dashboard / CVE / CVE-2012-2098

    CVE-2012-2098

    Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.

    Published:May 23, 2012
    Last Modified:Apr 11, 2025
    EPS:Jun 29, 2012
    EPSS Score:0.03171
    CVSS Score:5

    Affected Products

    Vendor
    Apache
    Product
    Commons Compress

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-25710 (CVSS 8.1) — Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue aff…
    CVE-2024-26308 (CVSS 5.5) — Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affec…
    CVE-2023-42503 (CVSS 5.5) — Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR p…
    CVE-2021-35515 (CVSS 7.5) — When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry c…
    CVE-2021-36090 (CVSS 7.5) — When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that fi…
    CVE-2021-35516 (CVSS 7.5) — When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that fin…
    CVE-2021-35517 (CVSS 7.5) — When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that fi…
    CVE-2019-12402 (CVSS 7.5) — The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infin…
    CVE-2018-11771 (CVSS 5.5) — When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArch…
    CVE-2018-1324 (CVSS 5.5) — A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra…

    References

    http://ant.apache.org/security.html
    http://archives.neohapsis.com/archives/bugtraq/2012-05/0130.html
    http://commons.apache.org/compress/security.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html
    http://osvdb.org/82161
    http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html
    http://secunia.com/advisories/49255
    http://secunia.com/advisories/49286
    http://www-01.ibm.com/support/docview.wss?uid=swg21644047
    http://www.openwall.com/lists/oss-security/2023/09/13/3
    http://www.securityfocus.com/bid/53676
    http://www.securitytracker.com/id?1027096
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75857
    https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
    https://www.oracle.com/security-alerts/cpujan2021.html
    http://ant.apache.org/security.html
    http://archives.neohapsis.com/archives/bugtraq/2012-05/0130.html
    http://commons.apache.org/compress/security.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html
    http://osvdb.org/82161
    http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html
    http://secunia.com/advisories/49255
    http://secunia.com/advisories/49286
    http://www-01.ibm.com/support/docview.wss?uid=swg21644047
    http://www.openwall.com/lists/oss-security/2023/09/13/3
    http://www.securityfocus.com/bid/53676
    http://www.securitytracker.com/id?1027096
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75857
    https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
    https://www.oracle.com/security-alerts/cpujan2021.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High