Skip to content

Dependency org.apache.commons:commons-compress, leading to CVE problem #1287

Closed
Closed
Dependency org.apache.commons:commons-compress, leading to CVE problem#1287

Description

@CVEDetect
CVEDetect
opened on Oct 5, 2021

Hi, In zstack/header，there is a dependency org.apache.commons:commons-compress:1.4.1 that calls the risk method.

CVE-2018-11771

The scope of this CVE affected version is [,1.18-RC1)

After further analysis, in this project, the main Api called is <org.apache.commons.compress.archivers.zip.ZipArchiveInputStream: int readStored(byte[],int,int)>

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 7

<org.apache.commons.compress.archivers.zip.ZipArchiveInputStream: int readStored(byte[],int,int)>
at <org.apache.commons.compress.archivers.zip.ZipArchiveInputStream: int read(byte[],int,int)> (org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.java:[321]) in /.m2/repository/org/apache/commons/commons-compress/1.4.1/commons-compress-1.4.1.jar
at <org.apache.commons.compress.archivers.ArchiveInputStream: int read()> (org.apache.commons.compress.archivers.ArchiveInputStream.java:[81]) in /.m2/repository/org/apache/commons/commons-compress/1.4.1/commons-compress-1.4.1.jar
at <org.apache.avro.io.DirectBinaryDecoder: long readLong()> (org.apache.avro.io.DirectBinaryDecoder.java:[123]) in /.m2/repository/org/apache/avro/avro/1.7.6/avro-1.7.6.jar
at <org.apache.avro.file.DataFileReader12: java.lang.Object next(java.lang.Object)> (org.apache.avro.file.DataFileReader12.java:[162, 165]) in /.m2/repository/org/apache/avro/avro/1.7.6/avro-1.7.6.jar
at <org.apache.avro.file.DataFileReader12: java.lang.Object next()> (org.apache.avro.file.DataFileReader12.java:[145]) in /.m2/repository/org/apache/avro/avro/1.7.6/avro-1.7.6.jar
at <org.zstack.header.vm.VmNicHelper: java.util.List getL3Uuids(java.util.List)> (org.zstack.header.vm.VmNicHelper.java:[38]) in /detect/unzip/zstack-master/header/target/classes

Dependency tree--

[INFO] org.zstack:header:jar:4.3.0
[INFO] +- org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
[INFO] +- org.hibernate:hibernate-search-orm:jar:5.8.2.Final:compile
[INFO] |  +- org.hibernate:hibernate-search-engine:jar:5.8.2.Final:compile
[INFO] |  |  +- org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
[INFO] |  |  +- org.apache.lucene:lucene-core:jar:5.5.5:compile
[INFO] |  |  +- org.apache.lucene:lucene-misc:jar:5.5.5:compile
[INFO] |  |  +- org.apache.lucene:lucene-analyzers-common:jar:5.5.5:compile
[INFO] |  |  +- org.apache.lucene:lucene-facet:jar:5.5.5:compile
[INFO] |  |  |  \- org.apache.lucene:lucene-queries:jar:5.5.5:compile
[INFO] |  |  \- org.apache.lucene:lucene-queryparser:jar:5.5.5:compile
[INFO] |  \- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
[INFO] |     +- antlr:antlr:jar:2.7.7:compile
[INFO] |     +- org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:jar:1.0.1.Final:compile
[INFO] |     +- org.jboss:jandex:jar:2.0.3.Final:compile
[INFO] |     +- com.fasterxml:classmate:jar:1.3.0:compile
[INFO] |     \- dom4j:dom4j:jar:1.6.1:compile
[INFO] +- org.hibernate:hibernate-search-serialization-avro:jar:5.8.2.Final:compile
[INFO] |  +- org.apache.avro:avro:jar:1.7.6:compile
[INFO] |  |  +- org.codehaus.jackson:jackson-core-asl:jar:1.9.13:compile
[INFO] |  |  +- org.codehaus.jackson:jackson-mapper-asl:jar:1.9.13:compile
[INFO] |  |  +- com.thoughtworks.paranamer:paranamer:jar:2.3:compile
[INFO] |  |  +- org.apache.commons:commons-compress:jar:1.4.1:compile
[INFO] |  |  \- org.slf4j:slf4j-api:jar:1.6.4:compile
[INFO] |  \- org.jboss.logging:jboss-logging:jar:3.3.0.Final:compile
[INFO] +- org.hibernate:hibernate-search-backend-jgroups:jar:5.8.2.Final:compile
[INFO] |  \- org.jgroups:jgroups:jar:3.6.12.Final:compile
[INFO] +- org.infinispan:infinispan-directory-provider:jar:8.2.4.Final:compile
[INFO] |  +- org.infinispan:infinispan-lucene-directory:jar:8.2.4.Final:compile
[INFO] |  \- org.infinispan:infinispan-core:jar:8.2.4.Final:compile
[INFO] |     +- org.infinispan:infinispan-commons:jar:8.2.4.Final:compile
[INFO] |     +- org.jboss.spec.javax.transaction:jboss-transaction-api_1.1_spec:jar:1.0.1.Final:compile
[INFO] |     \- org.jboss.marshalling:jboss-marshalling-osgi:jar:1.4.10.Final:compile
[INFO] +- com.rabbitmq:amqp-client:jar:3.3.5:compile
[INFO] +- org.springframework.security:spring-security-core:jar:4.2.18.RELEASE:compile
[INFO] |  +- aopalliance:aopalliance:jar:1.0:compile
[INFO] |  +- org.springframework:spring-aop:jar:4.3.30.RELEASE:compile
[INFO] |  +- org.springframework:spring-beans:jar:4.3.26.RELEASE:compile
[INFO] |  +- org.springframework:spring-context:jar:4.3.30.RELEASE:compile
[INFO] |  +- org.springframework:spring-core:jar:4.3.30.RELEASE:compile
[INFO] |  \- org.springframework:spring-expression:jar:4.3.26.RELEASE:compile
[INFO] +- javax.servlet:servlet-api:jar:2.5:provided
[INFO] +- org.springframework:spring-aspects:jar:4.3.30.RELEASE:compile
[INFO] +- org.springframework:spring-tx:jar:4.3.30.RELEASE:compile
[INFO] +- org.aspectj:aspectjrt:jar:1.8.9:compile
[INFO] +- org.aspectj:aspectjweaver:jar:1.8.9:compile
[INFO] +- org.zstack:utils:jar:4.3.0:compile
[INFO] |  +- junit:junit:jar:4.10:compile
[INFO] |  |  \- org.hamcrest:hamcrest-core:jar:1.1:compile
[INFO] |  +- commons-io:commons-io:jar:2.4:compile
[INFO] |  +- commons-codec:commons-codec:jar:1.9:compile
[INFO] |  +- commons-configuration:commons-configuration:jar:1.8:compile
[INFO] |  |  \- commons-lang:commons-lang:jar:2.6:compile
[INFO] |  +- com.google.code.gson:gson:jar:2.8.5:compile
[INFO] |  +- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
[INFO] |  +- org.apache.logging.log4j:log4j-core:jar:2.13.3:compile
[INFO] |  +- org.apache.logging.log4j:log4j-web:jar:2.13.3:compile
[INFO] |  +- org.apache.logging.log4j:log4j-1.2-api:jar:2.13.3:compile
[INFO] |  +- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.13.3:compile
[INFO] |  +- org.codehaus.groovy:groovy-all:jar:2.4.15:compile
[INFO] |  +- org.json:json:jar:20170516:compile
[INFO] |  +- com.google.guava:guava:jar:24.1.1-jre:compile
[INFO] |  |  +- com.google.code.findbugs:jsr305:jar:1.3.9:compile
[INFO] |  |  +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
[INFO] |  |  +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
[INFO] |  |  +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
[INFO] |  |  \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
[INFO] |  +- com.googlecode.gentyref:gentyref:jar:1.2.0:compile
[INFO] |  +- com.jcraft:jsch:jar:0.1.55:compile
[INFO] |  +- com.hierynomus:sshj:jar:0.30.0:compile
[INFO] |  |  +- org.bouncycastle:bcpkix-jdk15on:jar:1.66:runtime
[INFO] |  |  +- com.jcraft:jzlib:jar:1.1.3:runtime
[INFO] |  |  +- com.hierynomus:asn-one:jar:0.4.0:runtime
[INFO] |  |  \- net.i2p.crypto:eddsa:jar:0.3.0:runtime
[INFO] |  +- org.bouncycastle:bcprov-jdk15on:jar:1.67:compile
[INFO] |  +- commons-net:commons-net:jar:3.4:compile
[INFO] |  +- commons-validator:commons-validator:jar:1.6:compile
[INFO] |  |  +- commons-beanutils:commons-beanutils:jar:1.9.4:compile
[INFO] |  |  +- commons-digester:commons-digester:jar:1.8.1:compile
[INFO] |  |  \- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] |  +- com.github.ben-manes.caffeine:caffeine:jar:2.5.2:compile
[INFO] |  +- com.squareup.okhttp3:okhttp:jar:3.14.0:compile
[INFO] |  |  \- com.squareup.okio:okio:jar:1.17.2:compile
[INFO] |  +- com.squareup.okhttp3:logging-interceptor:jar:3.14.0:compile
[INFO] |  +- org.apache.poi:poi:jar:4.1.2:compile
[INFO] |  |  +- org.apache.commons:commons-collections4:jar:4.4:compile
[INFO] |  |  +- org.apache.commons:commons-math3:jar:3.6.1:compile
[INFO] |  |  \- com.zaxxer:SparseBitSet:jar:1.2:compile
[INFO] |  +- org.apache.poi:poi-ooxml:jar:4.1.2:compile
[INFO] |  |  +- org.apache.poi:poi-ooxml-schemas:jar:4.1.2:compile
[INFO] |  |  |  \- org.apache.xmlbeans:xmlbeans:jar:3.1.0:compile
[INFO] |  |  \- com.github.virtuald:curvesapi:jar:1.06:compile
[INFO] |  +- org.apache.commons:commons-csv:jar:1.5:compile
[INFO] |  +- com.googlecode.java-ipv6:java-ipv6:jar:0.17:compile
[INFO] |  +- info.debatty:java-string-similarity:jar:2.0.0:compile
[INFO] |  |  \- net.jcip:jcip-annotations:jar:1.0:compile
[INFO] |  \- com.github.sisyphsu:retree:jar:1.0.4:compile
[INFO] +- org.apache.httpcomponents:httpclient:jar:4.5.13:compile
[INFO] |  +- org.apache.httpcomponents:httpcore:jar:4.4.13:compile
[INFO] |  \- commons-logging:commons-logging:jar:1.2:compile
[INFO] +- org.reflections:reflections:jar:0.9.10:compile
[INFO] |  +- org.javassist:javassist:jar:3.21.0-GA:compile
[INFO] |  \- com.google.code.findbugs:annotations:jar:2.0.1:compile
[INFO] \- org.springframework:spring-web:jar:4.3.30.RELEASE:compile

Suggested solutions:

Update dependency version

Thank you very much.

Activity

  1. CVEDetect commented on Oct 5, 2021

    @CVEDetect
    CVEDetect
    on Oct 5, 2021
    ContributorAuthor

    @zxwing
    Could please help me check this issue?
    May I pull a request to fix it?
    Thanks again.

  2. AlanJager commented on Nov 17, 2021

    @AlanJager
    AlanJager
    on Nov 17, 2021
    Contributor

    @CVEDetect Thanks for your report. I think the recent hibernate search related packges upgrade caused this issue. Of course, patches are welcome！Feel free to create a pull request.

  3. ZStack-Robot
    closed this as completedin 4d3589bon Jun 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions