Junrar vulnerable to Infinite Loop · CVE-2018-12418 · GitHub Advisory Database · GitHub

Junrar vulnerable to Infinite Loop

Moderate severity GitHub Reviewed Published Oct 17, 2018 to the GitHub Advisory Database • Updated Jan 12, 2023

Package

com.github.junrar:junrar (Maven)

Affected versions

< 1.0.1

Patched versions

1.0.1

Description

Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.

References

Published to the GitHub Advisory Database Oct 17, 2018

Reviewed Jun 16, 2020

Last updated Jan 12, 2023

Severity

Moderate

5.5

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H