High severity · published Jul 13, 2021
CVE-2021-35516
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs
7.5
CVSS
12.4%
EPSS
No
On KEV
Description
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.4% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BD
Banking Digital Experience · Oracle
18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 · source: NVD
BE
Banking Enterprise Default Management · Oracle
2.7.0 · source: NVD
BP
Banking Party Management · Oracle
2.7.0 · source: NVD
BP
Business Process Management Suite · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
CG
Commerce Guided Search · Oracle
11.3.2 · source: NVD
CC
Commons Compress · Apache
1.6 through 1.20 · source: NVD
CB
Communications Billing And Revenue Management · Oracle
12.0.0.4 · source: NVD
CC
Communications Cloud Native Core Automated Test Suite · Oracle
1.8.0 · source: NVD
CC
Communications Cloud Native Core Service Communication Proxy · Oracle
1.14.0 · source: NVD
CC
Communications Cloud Native Core Unified Data Repository · Oracle
1.14.0 · source: NVD
CD
Communications Diameter Intelligence Hub · Oracle
8.0.0 through 8.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35516
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35516
Mailing List
http://www.openwall.com/lists/oss-security/2021/07/13/2
Vendor Advisory
https://commons.apache.org/proper/commons-compress/security-reports.html
lists.apache.org
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E
More from Commons Compress
7.5
CVE-2021-35515
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop
7.5
CVE-2021-36090
Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
7.5
CVE-2021-35517
Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
7.5
CVE-2019-12402
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs
5.5
CVE-2024-26308
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26