CVE-2023-42503
mediumpriority · track · 22EPSS 0.006 · 49 %ileDEEUNLRUUSEPSS · scored 2026-10-27
Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption. In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values. Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5]. [1]: https://issues.apache.org/jira/browse/COMPRESS-612 [2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 [3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html [4]: https://bugs.openjdk.org/browse/JDK-6560193 [5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (26)
Products and version ranges known to be affected.
- enterprise_manager_for_peoplesoftall versionsncsc_nlNLcpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.5.1.1:*:*:*:*:*:*:*
- peoplesoft_enterprise_cc_common_application_objectsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*
- peoplesoft_enterprise_crm_client_managementall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_crm_client_management:9.2:*:*:*:*:*:*:*
- peoplesoft_enterprise_hcm_benefits_administrationall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_hcm_benefits_administration:9.2:*:*:*:*:*:*:*
- peoplesoft_enterprise_hcm_global_payroll_switzerlandall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_switzerland:9.2:*:*:*:*:*:*:*
- peoplesoft_enterprise_hcm_human_resourcesall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*
- peoplesoft_enterprise_hcm_shared_componentsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_hcm_shared_components:9.2:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.59:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.60:*:*:*:*:*:*:*
advisories (13)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0304Kwetsbaarheden verholpen in Oracle PeopleSoftNL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle PeopleSoft.
- WID-SEC-W-2023-2352Apache Commons: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-09-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Commons ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-0105Oracle Construction and Engineering: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0107Oracle Communications Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0113Oracle Utilities Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0123Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0124Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0873Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2024-04-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0874Oracle Enterprise Manager: Mehrere SchwachstellenDeutsch2024-04-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Enterprise Manager ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0890Oracle Supply Chain: Mehrere SchwachstellenDeutsch2024-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0898Oracle Health Sciences Applications: Mehrere SchwachstellenDeutsch2024-04-16csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Oracle Health Sciences Applications ausnutzen, um die Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-1655Oracle PeopleSoft: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle PeopleSoft ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-cgwf-w82q-5jrrApache Commons Compress denial of service vulnerability2023-09-14ghsa · osvUS
Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption. In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values. Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5]. [1]: https://issues.apache.org/jira/browse/COMPRESS-612 [2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 [3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html [4]: https://bugs.openjdk.org/browse/JDK-6560193 [5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-42503/cnnvd
- https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93ccnnvd
- https://security.netapp.com/advisory/ntap-20231020-0003/cnnvd
- https://vigilance.fr/vulnerability/Apache-Commons-Compress-overload-via-TAR-Parsing-43911cnnvd
- https://www.oracle.com/security-alerts/cpuapr2024.htmlcnnvd
- https://www.oracle.com/security-alerts/cpujan2024.htmlcnnvd
- https://www.oracle.com/security-alerts/cpujul2024.htmlcnnvd
- https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93cenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan