Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2024-25710

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Feb 19, 2024 | Modified: Mar 07, 2024
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
5.5 MODERATE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-25710
CWEhttps://cwe.mitre.org/data/definitions/835.html

Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Commons_compress Apache 1.3 (including) 1.26.0 (excluding)
CEQ 3.2 RedHat commons-compress *
Migration Toolkit for Runtimes 1 on RHEL 8 RedHat commons-compress *
MTA-6.2-RHEL-9 RedHat mta/mta-windup-addon-rhel9:6.2.3-2 *
Red Hat AMQ Streams 2.7.0 RedHat *
Red Hat build of Quarkus 3.2.11.Final RedHat org.apache.commons/commons-compress:1.26.0.redhat-00001 *
Red Hat Data Grid RedHat commons-compress *
RHINT Service Registry 2.5.11 GA RedHat commons-compress *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-data-index-ephemeral-rhel8:1.33.0-5 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-data-index-postgresql-rhel8:1.33.0-5 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-jobs-service-ephemeral-rhel8:1.33.0-5 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-jobs-service-postgresql-rhel8:1.33.0-5 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8:1.33.0-5 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-operator-bundle:1.33.0-5 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-rhel8-operator:1.33.0-3 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-swf-builder-rhel8:1.33.0-5 *
RHOSS-1.33-RHEL-8 RedHat openshift-serverless-1/logic-swf-devmode-rhel8:1.33.0-5 *
Libcommons-compress-java Ubuntu bionic *
Libcommons-compress-java Ubuntu mantic *
Libcommons-compress-java Ubuntu trusty *
Libcommons-compress-java Ubuntu xenial *

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use