High severity · published Jul 13, 2021
CVE-2021-35517
Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
7.5
CVSS
10.6%
EPSS
No
On KEV
Description
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache Commons Compress · Apache Software Foundation
1.1 before Apache Commons Compress* · source: vendor
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BA
Banking Apis · Oracle
18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 · source: NVD
BD
Banking Digital Experience · Oracle
18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 · source: NVD
BE
Banking Enterprise Default Management · Oracle
2.7.0 · source: NVD
BP
Banking Party Management · Oracle
2.7.0 · source: NVD
BP
Banking Payments · Oracle
14.5 · source: NVD
BT
Banking Trade Finance · Oracle
14.5 · source: NVD
BT
Banking Treasury Management · Oracle
14.5 · source: NVD
BP
Business Process Management Suite · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
CG
Commerce Guided Search · Oracle
11.3.2 · source: NVD
CC
Commons Compress · Apache
1.1 through 1.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35517
Mailing List
http://www.openwall.com/lists/oss-security/2021/07/13/3
Mailing List
http://www.openwall.com/lists/oss-security/2021/07/13/5
Vendor Advisory
https://commons.apache.org/proper/commons-compress/security-reports.html
lists.apache.org
https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29%40%3Cissues.flink.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975%40%3Cannounce.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E
More from Apache Commons Compress
7.5
CVE-2021-36090
Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
5.5
CVE-2018-11771
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after…