Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-p41w-msyv-u7bk

Summary

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Aliases

alias	CVE-2024-25710

alias	GHSA-4g9r-vxhx-9pgx

Fixed_packages

url pkg:deb/debian/libcommons-compress-java@1.0-1

purl pkg:deb/debian/libcommons-compress-java@1.0-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-fd7z-aksz-b7hv

vulnerability	VCID-h5ex-bm2j-fken

vulnerability	VCID-z5bc-s8qs-zbh1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.0-1

url	pkg:deb/debian/libcommons-compress-java@1.27.1-1?distro=trixie
purl	pkg:deb/debian/libcommons-compress-java@1.27.1-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.27.1-1%3Fdistro=trixie

url	pkg:deb/debian/libcommons-compress-java@1.27.1-2?distro=trixie
purl	pkg:deb/debian/libcommons-compress-java@1.27.1-2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.27.1-2%3Fdistro=trixie

url	pkg:deb/debian/libcommons-compress-java@1.27.1-2
purl	pkg:deb/debian/libcommons-compress-java@1.27.1-2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.27.1-2

url	pkg:maven/org.apache.commons/commons-compress@1.26.0
purl	pkg:maven/org.apache.commons/commons-compress@1.26.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.26.0

Affected_packages

url pkg:deb/debian/libcommons-compress-java@0~svn604876-1

purl pkg:deb/debian/libcommons-compress-java@0~svn604876-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-fd7z-aksz-b7hv

vulnerability	VCID-h5ex-bm2j-fken

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

vulnerability	VCID-z5bc-s8qs-zbh1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@0~svn604876-1

url pkg:deb/debian/libcommons-compress-java@1.20-1?distro=trixie

purl pkg:deb/debian/libcommons-compress-java@1.20-1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.20-1%3Fdistro=trixie

url pkg:deb/debian/libcommons-compress-java@1.20-1

purl pkg:deb/debian/libcommons-compress-java@1.20-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.20-1

url pkg:deb/debian/libcommons-compress-java@1.22-1

purl pkg:deb/debian/libcommons-compress-java@1.22-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cg72-sg2w-t3ft

vulnerability	VCID-k4wn-j55z-b3dk

vulnerability	VCID-p41w-msyv-u7bk

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.22-1

url pkg:deb/debian/libcommons-compress-java@1.22-1?distro=trixie

purl pkg:deb/debian/libcommons-compress-java@1.22-1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cg72-sg2w-t3ft

vulnerability	VCID-k4wn-j55z-b3dk

vulnerability	VCID-p41w-msyv-u7bk

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libcommons-compress-java@1.22-1%3Fdistro=trixie

url pkg:maven/org.apache.commons/commons-compress@1.3

purl pkg:maven/org.apache.commons/commons-compress@1.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-h5ex-bm2j-fken

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.3

url pkg:maven/org.apache.commons/commons-compress@1.4

purl pkg:maven/org.apache.commons/commons-compress@1.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-h5ex-bm2j-fken

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.4

url pkg:maven/org.apache.commons/commons-compress@1.4.1

purl pkg:maven/org.apache.commons/commons-compress@1.4.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.4.1

url pkg:maven/org.apache.commons/commons-compress@1.5

purl pkg:maven/org.apache.commons/commons-compress@1.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.5

url pkg:maven/org.apache.commons/commons-compress@1.6

purl pkg:maven/org.apache.commons/commons-compress@1.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.6

url pkg:maven/org.apache.commons/commons-compress@1.7

purl pkg:maven/org.apache.commons/commons-compress@1.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.7

url pkg:maven/org.apache.commons/commons-compress@1.8

purl pkg:maven/org.apache.commons/commons-compress@1.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.8

url pkg:maven/org.apache.commons/commons-compress@1.8.1

purl pkg:maven/org.apache.commons/commons-compress@1.8.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.8.1

url pkg:maven/org.apache.commons/commons-compress@1.9

purl pkg:maven/org.apache.commons/commons-compress@1.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.9

url pkg:maven/org.apache.commons/commons-compress@1.10

purl pkg:maven/org.apache.commons/commons-compress@1.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.10

url pkg:maven/org.apache.commons/commons-compress@1.11

purl pkg:maven/org.apache.commons/commons-compress@1.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-fd7z-aksz-b7hv

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.11

url pkg:maven/org.apache.commons/commons-compress@1.12

purl pkg:maven/org.apache.commons/commons-compress@1.12

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-fd7z-aksz-b7hv

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.12

url pkg:maven/org.apache.commons/commons-compress@1.13

purl pkg:maven/org.apache.commons/commons-compress@1.13

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-fd7z-aksz-b7hv

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.13

url pkg:maven/org.apache.commons/commons-compress@1.14

purl pkg:maven/org.apache.commons/commons-compress@1.14

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-fd7z-aksz-b7hv

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.14

url pkg:maven/org.apache.commons/commons-compress@1.15

purl pkg:maven/org.apache.commons/commons-compress@1.15

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-fd7z-aksz-b7hv

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

vulnerability	VCID-z5bc-s8qs-zbh1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.15

url pkg:maven/org.apache.commons/commons-compress@1.16

purl pkg:maven/org.apache.commons/commons-compress@1.16

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

vulnerability	VCID-z5bc-s8qs-zbh1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.16

url pkg:maven/org.apache.commons/commons-compress@1.16.1

purl pkg:maven/org.apache.commons/commons-compress@1.16.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

vulnerability	VCID-z5bc-s8qs-zbh1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.16.1

url pkg:maven/org.apache.commons/commons-compress@1.17

purl pkg:maven/org.apache.commons/commons-compress@1.17

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75h3-dr39-3qb8

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

vulnerability	VCID-z5bc-s8qs-zbh1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.17

url pkg:maven/org.apache.commons/commons-compress@1.18

purl pkg:maven/org.apache.commons/commons-compress@1.18

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

vulnerability	VCID-z5bc-s8qs-zbh1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.18

url pkg:maven/org.apache.commons/commons-compress@1.19

purl pkg:maven/org.apache.commons/commons-compress@1.19

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.19

url pkg:maven/org.apache.commons/commons-compress@1.20

purl pkg:maven/org.apache.commons/commons-compress@1.20

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-p41w-msyv-u7bk

vulnerability	VCID-qsw3-wm4k-m7h3

vulnerability	VCID-qu4m-4u1a-r3cv

vulnerability	VCID-vaar-ytpp-eqc7

vulnerability	VCID-y6ff-umvz-zbgd

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.20

url pkg:maven/org.apache.commons/commons-compress@1.21

purl pkg:maven/org.apache.commons/commons-compress@1.21

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cg72-sg2w-t3ft

vulnerability	VCID-p41w-msyv-u7bk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.21

url pkg:maven/org.apache.commons/commons-compress@1.22

purl pkg:maven/org.apache.commons/commons-compress@1.22

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cg72-sg2w-t3ft

vulnerability	VCID-k4wn-j55z-b3dk

vulnerability	VCID-p41w-msyv-u7bk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.22

url pkg:maven/org.apache.commons/commons-compress@1.23.0

purl pkg:maven/org.apache.commons/commons-compress@1.23.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cg72-sg2w-t3ft

vulnerability	VCID-k4wn-j55z-b3dk

vulnerability	VCID-p41w-msyv-u7bk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.23.0

url pkg:maven/org.apache.commons/commons-compress@1.24.0

purl pkg:maven/org.apache.commons/commons-compress@1.24.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cg72-sg2w-t3ft

vulnerability	VCID-p41w-msyv-u7bk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.24.0

url pkg:maven/org.apache.commons/commons-compress@1.25.0

purl pkg:maven/org.apache.commons/commons-compress@1.25.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cg72-sg2w-t3ft

vulnerability	VCID-p41w-msyv-u7bk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-compress@1.25.0

References

reference_url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-25710.json

reference_id

reference_type

scores

value	5.5
scoring_system	cvssv3
scoring_elements	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-25710.json

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2024-25710

reference_id

reference_type

scores

value	0.00018
scoring_system	epss
scoring_elements	0.04965
published_at	2026-05-12T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04969
published_at	2026-05-11T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04962
published_at	2026-05-09T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04919
published_at	2026-05-07T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.0487
published_at	2026-05-05T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04873
published_at	2026-04-29T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.0486
published_at	2026-04-26T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.0463
published_at	2026-04-02T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04666
published_at	2026-04-07T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04653
published_at	2026-04-04T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04821
published_at	2026-04-24T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04787
published_at	2026-04-21T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04648
published_at	2026-04-18T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04639
published_at	2026-04-16T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04672
published_at	2026-04-13T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04689
published_at	2026-04-12T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04706
published_at	2026-04-11T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.04713
published_at	2026-04-09T12:55:00Z

value	0.00018
scoring_system	epss
scoring_elements	0.047
published_at	2026-04-08T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2024-25710

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25710
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25710

reference_url

http://seclists.org/fulldisclosure/2024/Aug/37

reference_id

reference_type

scores

value	5.9
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

http://seclists.org/fulldisclosure/2024/Aug/37

reference_url

https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

reference_url

https://github.com/apache/commons-compress

reference_id

reference_type

scores

value	5.9
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://github.com/apache/commons-compress

reference_url

https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf

reference_id

reference_type

scores

value	5.9
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

value	8.1
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

value	MODERATE
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:19:19Z/

url

https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2024-25710

reference_id

reference_type

scores

value	5.9
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2024-25710

reference_url

https://security.netapp.com/advisory/ntap-20240307-0010

reference_id

reference_type

scores

value	5.9
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://security.netapp.com/advisory/ntap-20240307-0010

reference_url

http://www.openwall.com/lists/oss-security/2024/02/19/1

reference_id

reference_type

scores

value	5.9
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

value	8.1
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

value	MODERATE
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:19:19Z/

url

http://www.openwall.com/lists/oss-security/2024/02/19/1

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064413
reference_id	1064413
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064413

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=2264988
reference_id	2264988
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=2264988

reference_url

https://github.com/advisories/GHSA-4g9r-vxhx-9pgx

reference_id

GHSA-4g9r-vxhx-9pgx

reference_type

scores

value	MODERATE
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-4g9r-vxhx-9pgx

reference_url

https://security.netapp.com/advisory/ntap-20240307-0010/

reference_id

ntap-20240307-0010

reference_type

scores

value	8.1
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:19:19Z/

url

https://security.netapp.com/advisory/ntap-20240307-0010/

reference_url	https://access.redhat.com/errata/RHSA-2024:1509
reference_id	RHSA-2024:1509
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2024:1509

reference_url	https://access.redhat.com/errata/RHSA-2024:1797
reference_id	RHSA-2024:1797
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2024:1797

reference_url	https://access.redhat.com/errata/RHSA-2024:1924
reference_id	RHSA-2024:1924
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2024:1924

reference_url	https://access.redhat.com/errata/RHSA-2025:7625
reference_id	RHSA-2025:7625
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2025:7625

Weaknesses

cwe_id	835
name	Loop with Unreachable Exit Condition ('Infinite Loop')
description	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score 4.0 - 8.1

Exploitability 0.5

Weighted_severity 7.3

Risk_score 3.6

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p41w-msyv-u7bk

Vulnerability Instance