Description
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
NationalSecurityAgency ghidra
Default version status: unaffected
0 to < 12.2affected
pkg:github/NationalSecurityAgency/ghidraReferences
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954 ↗
- https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957 ↗
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build ↗
- https://github.com/NationalSecurityAgency/ghidra ↗
- https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mount ↗