CVE-2019-12900: Critical severity Bzip bzip2 vulnerability
BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Other sources
There were several "Security Fixes" for bzip2: out-of-bounds write in function BZ2decompress (CVE-2019-12900). e.g. RHSA-2024:8922 and RHSA-2024:10803.
The problem is that CVE-2019-12900 is 5 years old and bogus. The applied patch causes a change in behavior which causes some bz2 files to no longer decompress.
Upstream did a better fix for bzip2 1.0.8. Full story is here: https://gnu.wildebeest.org/blog/mjw/2019/08/02/bzip2-and-the-cve-that-wasnt/
You can see check that the new bzip2 is broken by running the upstream bzip2 testsuite:
$ git clone https://sourceware.org/git/bzip2-tests.git $ cd bzip2-tests $ ./run-tests.sh [...] bzip2: Data integrity error when decompressing. FAIL: ./lbzip2/32767.bz2 Decompress [...] Bad results, look for FAIL and !!! in the logs above - ./lbzip2/32767.bz2 bad decompress result
There should obviously be no FAILs.
Please revert this patch or apply the followup patch from 1.0.8: https://inbox.sourceware.org/bzip2-devel/f9230fc65a3529b59b31f13494c72a1c01a6148e.camel@klomp.org/ https://sourceware.org/cgit/bzip2/commit/?id=b07b105d1b66e32760095e3602261738443b9e13
Upstream reminder to Please don't "fix" CVE-2019-12900: https://inbox.sourceware.org/bzip2-devel/20241108214034.GC8315@gnu.wildebeest.org
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-12900?
CVE-2019-12900 is a vulnerability in the BZ2_decompress function in bzip2 through version 1.0.6 that allows an out-of-bounds write when there are many selectors.
What is the severity of CVE-2019-12900?
The severity of CVE-2019-12900 is critical with a CVSS score of 9.8.
How does CVE-2019-12900 affect bzip2?
CVE-2019-12900 affects bzip2 versions 1.0.6 through 1.0.8 causing an out-of-bounds write in the BZ2_decompress function.
How can I fix CVE-2019-12900 in bzip2?
To fix CVE-2019-12900 in bzip2, update to version 1.0.9 or later.
Are there any references for CVE-2019-12900?
Yes, you can find references for CVE-2019-12900 at the following links: [1] GitLab commit: 74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc [2] Debian LTS announce: June 2019 message [3] Ubuntu Security Notice: USN-4038-2.