A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

The 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic     Server. (CVE-2022-21306)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web     Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base     Score 7.5 (Confidentiality impacts). (CVE-2022-21371)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples).
    Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle WebLogic Server accessible data. (CVE-2022-21292)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix infinite loop security vulnerability (CVE-2018-1324)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
157127	Oracle WebLogic Server (Jan 2022 CPU)	Nessus	Misc.	critical
108675	Fedora 27 : apache-commons-compress (2018-cf918d73cc)	Nessus	Fedora Local Security Checks	medium
108666	Fedora 26 : apache-commons-compress (2018-0c2141fcbc)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-1324

medium

Tenable Plugins

critical

medium

medium