Bug#939610: libcommons-compress-java: CVE-2019-12402

[Salvatore Bonaccorso]

Source: libcommons-compress-java
Version: 1.18-2
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for libcommons-compress-java.

CVE-2019-12402[0]:
| The file name encoding algorithm used internally in Apache Commons
| Compress 1.15 to 1.18 can get into an infinite loop when faced with
| specially crafted inputs. This can lead to a denial of service attack
| if an attacker can choose the file names inside of an archive created
| by Compress.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-12402
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12402

Regards,
Salvatore