Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ttps://access.redhat.com/errata/RHSA-2019:2720 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/ - https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/ - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:2937 - https://access.redh
https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:2937 - https://access.redhat.com/errata/RHSA-2019:2935 - https://access.redhat.com/errata/RHSA-2019:2936 - https://access.redhat.com/errata/RHSA-2019:2938 - https://www.debian.org/security/2019/dsa-4542 - https://seclists.org/bugtraq/2019/Oct/6 - https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe%40%3Cnotifications.geode.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:2998 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 -
f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3200 - https://access.redhat.com/errata/RHSA-2019:3292 - https://access.redhat.com/errata/RHSA-2019:3297 - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3901
ab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3901 - https://access.redhat.com/errata/RHSA-2019:4352 - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://doyensec.com/research.html - https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad - https://lists.debian.org/debian-lts-an
.html - https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad - https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html - https://security.netapp.com/advisory/ntap-20190703-0002/ - https://blog.doyensec.com/2019/07/22/jackson-gadgets.html - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2019-12385 State: PUBLISHED Published: 2019-08-22T18:19:41 Last Updated: 2024-08-04T23:17:39.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality. Additional Analyst Notes: - CVE Program Container: References: - https://www.tarlogic.com/en/blog/vulnerabilities-in-
y. Additional Analyst Notes: - CVE Program Container: References: - https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/ - https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html
CVE ID: CVE-2019-12386 State: PUBLISHED Published: 2019-08-22T18:21:04 Last Updated: 2024-08-04T23:17:39.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/ - https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html
CVE ID: CVE-2019-12387 State: PUBLISHED Published: 2019-06-10T11:34:49 Last Updated: 2024-08-04T23:17:39.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. Additional Analyst Notes: - CVE Program Container: References: - https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html - https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2 - https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html - http://l
ted-python/2019-June/032352.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N/ - https://usn.ubuntu.com/4308-2/ - https://usn.ubuntu.com/4308-1/ - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2019-12388 State: PUBLISHED Published: 2019-12-02T16:40:54 Last Updated: 2024-08-04T23:17:40.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE ID: CVE-2019-12389 State: PUBLISHED Published: 2019-12-02T16:37:48 Last Updated: 2024-08-04T23:17:39.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5010. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE ID: CVE-2019-12390 State: PUBLISHED Published: 2019-12-02T16:35:28 Last Updated: 2024-08-04T23:17:39.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without credentials via port tcp/5010. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE ID: CVE-2019-12391 State: PUBLISHED Published: 2019-12-02T16:16:20 Last Updated: 2024-08-04T23:17:39.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Anviz Management System for access control has insufficient logging for device events such as door open requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE ID: CVE-2019-12392 State: PUBLISHED Published: 2019-12-02T16:26:00 Last Updated: 2024-08-04T23:17:39.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anviz access control devices allow remote attackers to issue commands without a password. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE ID: CVE-2019-12393 State: PUBLISHED Published: 2019-12-02T16:05:31 Last Updated: 2024-08-04T23:17:40.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE ID: CVE-2019-12394 State: PUBLISHED Published: 2019-12-02T16:29:20 Last Updated: 2024-08-04T23:17:39.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE ID: CVE-2019-12395 State: PUBLISHED Published: 2019-05-28T12:41:32 Last Updated: 2024-08-04T23:17:39.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/webbukkit/dynmap/commit/641f142cd3ccdcbfb04eda3059be22dd9ed93783 - https://github.com/webbukkit/dynmap/issues/2474 - https://github.com/webbukkit/dynmap/pull/2475 - http://jvn.jp/en/jp/JVN89046645/index.html
CVE ID: CVE-2019-12396 State: REJECTED Published: 2019-05-28T12:53:22 Last Updated: 2019-05-30T14:12:25 Description: No description available.
CVE ID: CVE-2019-12397 State: PUBLISHED Published: 2019-08-08T17:06:43 Last Updated: 2024-08-04T23:17:40.107Z Vendors: Apache Software Foundation Products: Apache Ranger Problem Types: Cross-site scripting Description: Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix. Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger - http://www.openwall.com/lists/oss-security/2019/08/08/1 - https://lists.apache.org/thread.html/ab2de1adad96f5dbd19d976b28715dfc60dbe75e82a74f48be8ef695%40%3Cde
ity/2019/08/08/1 - https://lists.apache.org/thread.html/ab2de1adad96f5dbd19d976b28715dfc60dbe75e82a74f48be8ef695%40%3Cdev.ranger.apache.org%3E - https://lists.apache.org/thread.html/cbc6346708ef2b9ffb2555637311bf6294923c609c029389fa39de8f%40%3Cdev.ranger.apache.org%3E - https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c%40%3Cdev.ranger.apache.org%3E - https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998%40%3Cdev.ranger.apache.org%3E
CVE ID: CVE-2019-12398 State: PUBLISHED Published: 2020-01-14T16:28:35 Last Updated: 2024-08-04T23:17:40.125Z Vendors: Apache Products: Airflow Problem Types: Stored XSS Description: In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b%40%3Cdev.airflow.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/01/14/2 - https://lists.apache.o
53352b%40%3Cdev.airflow.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/01/14/2 - https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b%40%3Cusers.airflow.apache.org%3E
CVE ID: CVE-2019-12399 State: PUBLISHED Published: 2020-01-14T14:28:57 Last Updated: 2024-08-04T23:17:40.107Z Vendors: Apache Products: Kafka Problem Types: Information Disclosure Description: When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables. Add
ask configuration and the response will contain the plaintext secret rather than the externalized secrets variables. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9%40%3Cusers.kafka.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/01/14/1 - https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/rc27d424d0bdeaf31081c3e246db3c66e882243ae3f3
aff89d9%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/rc27d424d0bdeaf31081c3e246db3c66e882243ae3f342dfa845e0261%40%3Ccommits.kafka.apache.org%3E - https://lists.apache.org/thread.html/rde947ee866de6687bc51cdc8dfa6d7e6b3ad4ce8c708c344f773e6dc%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r4b20b40c40d4a4c641e2ef4228098a57935e5782bfdfdf3650e48265%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r6fa1cff4786dcef2ddd1d717836ef123c878e8321c24855bad24ae0f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r3203d7f25a6ca56ff3e48c43a6aa7cb60b8e5d57d0eed9f76dc2b7a8%40%3Ccommits.druid.apache.org%3E - https://lis
org/thread.html/r3203d7f25a6ca56ff3e48c43a6aa7cb60b8e5d57d0eed9f76dc2b7a8%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rfe90ca0463c199b99c2921410639aed53a172ea8b733eab0dc776262%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r801c68bf987931f35d2e24ecc99f3aa2850fdd8f5ef15fe6c60fecf3%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r3154f5adbc905f1f9012a92240c8e00a96628470cc819453b9606d0e%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r4d9e87cdae99e98d7b244cfa53d9d2532d368d3a187fbc87c493dcbe%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r56eb055b544931451283fee51f7e1f5b8
fbc87c493dcbe%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r56eb055b544931451283fee51f7e1f5b8ebd3085fed7d77aaba504c9%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r0e3a613705d70950aca2bfe9a6265c87503921852d9a3dbce512ca9f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r9871a4215b621c1d09deee5eba97f0f44fde01b4363deb1bed0dd160%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r47c225db363d1ee2c18c4b3b2f51b63a9789f78c7fa602e5976ecd05%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r2d390dec5f360ec8aa294bef18e1a4385e2a3698d747209216f5a48b%40%3Ccommits.druid.apache.org%3E - h
ts.apache.org/thread.html/r2d390dec5f360ec8aa294bef18e1a4385e2a3698d747209216f5a48b%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.apache.org/thread.html/rda253155601968331b5cf0da4f273813bbd91843c2568a8495d1c662%40%3Ccommits.kafka.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-12400 State: PUBLISHED Published: 2019-08-23T20:30:33 Last Updated: 2024-08-04T23:17:40.035Z Vendors: Apache Products: Apache Santuario - XML Security for Java Problem Types: Process Control Description: In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability
o - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/8e814b925bf580bc527d96ff51e72ffe5bdeaa4b8bf5b89498cab24c%40%3Cdev.santuario.apache.org%3E - https://lists.apache.org/thread.html/edaa7edb9c58e5f5bd0c950f2b6232b62b15f5c44ad803e8728308ce%40%3Cdev.santuario.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0806 - https://access.redhat.com/errata/RHSA-2020:0811 - https://access.redhat.com/errata/RHSA-2020:08
/errata/RHSA-2020:0806 - https://access.redhat.com/errata/RHSA-2020:0811 - https://access.redhat.com/errata/RHSA-2020:0804 - https://access.redhat.com/errata/RHSA-2020:0805 - https://lists.apache.org/thread.html/rcdc0da94fe21b26493eae47ca987a290bdf90c721a7a42491fdd41d4%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/rf82be0a7c98cd3545e20817bb96ed05551ea0020acbaf9a469fef402%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r107bffb06a5e27457fe9af7dfe3a233d0d36c6c2f5122f117eb7f626%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/rf958cea96236de8829940109ae07e870aa3d59235345421e4924ff03%40%3Ccommits.tomee.apache.org%3E - https
pache.org/thread.html/rf958cea96236de8829940109ae07e870aa3d59235345421e4924ff03%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - http://santuario.apache.org/secadv.data/CVE-2019-12400.asc?version=1&modificationDate=1566573083000&api=v2 - https://security.netapp.com/advisory/ntap-20190910-0003/
CVE ID: CVE-2019-12401 State: PUBLISHED Published: 2019-09-10T14:06:54 Last Updated: 2024-08-04T23:17:40.122Z Vendors: Apache Products: Solr Problem Types: XML Entity Expansion Description: Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/7ab5e95a1a0b4f35ffe53f1eb0cb74b4348b49d41b72ac155b843fa2%40%3Cgeneral.lucene.apache.org%3E - https:
ache.org/thread.html/7ab5e95a1a0b4f35ffe53f1eb0cb74b4348b49d41b72ac155b843fa2%40%3Cgeneral.lucene.apache.org%3E - https://lists.apache.org/thread.html/048ae6e4f84a88e8856f766320b48ad91f9fca2c6f621aa2c40088fe%40%3Cdev.lucene.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/09/10/1 - https://lists.apache.org/thread.html/521d10a19bfb590f86dff41820ccfb11e92281f233a12c882650931e%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thread.html/1c92300643f48f13bc59b15e3f886ba62bae1798c7d4c2e5c1ece09b%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/60a924662ead9aeea74e8ea128d9ca935f8de925aa71b15ab2787d6a%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache
html/60a924662ead9aeea74e8ea128d9ca935f8de925aa71b15ab2787d6a%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/db8eaca456d03c00a66cbe37548978318d424b9997e3fd7f5c65dffe%40%3Cdev.lucene.apache.org%3E - http://mail-archives.us.apache.org/mod_mbox/www-announce/201909.mbox/%3CCAECwjAXU4%3DkAo5DeUJw7Kvk67sgCmajAN7LGZQNjbjZ8gv%3DBdw%40mail.gmail.com%3E - https://lists.apache.org/thread.html/0ec231c5ed8d242890e21806d25fdd47f80cc47cac278d2fc1c9c579%40%3Cdev.lucene.apache.org%3E - https://security.netapp.com/advisory/ntap-20190926-0002/ - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-12401-XML%20Bomb-Apache%20Solr
CVE ID: CVE-2019-12402 State: PUBLISHED Published: 2019-08-29T00:00:00 Last Updated: 2024-08-04T23:17:39.992Z Vendors: Apache Software Foundation Products: Apache Commons Compress Problem Types: denial of service vulnerability Description: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.
eferences: - https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL/ - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r5caf4fcb69d2749225391e61db7216282955204849ba94f83afe011f%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.
f4fcb69d2749225391e61db7216282955204849ba94f83afe011f%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/rcc35ab6be300365de5ff9587e0479d10d7d7c79070921837e3693162%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/re13bd219dd4b651134f6357f12bd07a0344eea7518c577bbdd185265%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r5103b1c9242c0f812ac96e524344144402cbff9b6e078d1557bc7b1e%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r590c15cebee9b8e757e2f738127a9a71e48ede647a3044c504e050a4%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3%4
s.flink.apache.org%3E - https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/rdebc1830d6c09c11d5a4804ca26769dbd292d17d361c61dea50915f0%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/rd3f99d732baed459b425fb0a9e9e14f7843c9459b12037e4a9d753b5%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread
3267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r972f82d821b805d04602976a9736c01b6bf218cfe0c3f48b472db488%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873b