Security Vulnerability - Action Required: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability may in your project

[Crispy-fried-chicken]

Please check before submitting an issue

• I know what my device, OS and App Manager versions are
• I know how to take logs
• I know how to reproduce the issue which may not be specific to my device

Describe the bug

Hi,
we have detected that your project may be vulnerable to Out-of-bounds Write in the function of readGlobalPaxHeaders in the file of app/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveInputStream.java . It shares similarities to a recent CVE disclosure CVE-2021-35515 in the commons-compress.

The source vulnerability information is as follows:

Vulnerability Detail:
CVE Identifier: CVE-2021-35515
Description: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-35515
Patch: apache/commons-compress@d0af873

Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!

To Reproduce

No response

Expected behavior

No response

Screenshots

No response

Logs

No response

Device info

• Device:
• OS Version:
• App Manager Version:
• Mode: Root/ADB/NonRoot

Additional context

No response

[MuntashirAkon]

Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!

I can confirm that the issue is present in App Manager. Please read the contributing doc before opening a PR.

[MuntashirAkon]

I'm not classifying it as a security vulnerability because it only affects a single feature (e.g., backup/restore) and does not cause the whole application to become not functional.

[Crispy-fried-chicken]

I can confirm that the issue is present in App Manager. Please read the contributing doc before opening a PR.

Ok, I've already open a PR which is #1490, please review it, thank you!