CVE-2021-35517

HIGH7.5

Description

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products

apache / commons_compress1.1 – 1.20
Apache Software Foundation / Apache Commons Compress1.1 – Apache Commons Compress*
NetApp / active_iq_unified_manager
NetApp / active_iq_unified_manager
NetApp / active_iq_unified_manager
NetApp / OnCommand Insight
oracle / banking_apis18.1 – 18.3
oracle / banking_apis19.1 – 19.1
oracle / banking_apis19.2 – 19.2
oracle / banking_apis20.1 – 20.1
oracle / banking_apis21.1 – 21.1
oracle / banking_digital_experience19.2 – 19.2
oracle / banking_digital_experience18.1 – 18.3
oracle / banking_digital_experience19.1 – 19.1
oracle / banking_digital_experience20.1 – 20.1
oracle / banking_digital_experience21.1 – 21.1
oracle / banking_enterprise_default_management2.7.0 – 2.7.0
oracle / banking_party_management2.7.0 – 2.7.0
oracle / banking_payments14.5 – 14.5
oracle / banking_trade_finance14.5 – 14.5
oracle / banking_treasury_management14.5 – 14.5
oracle / business_process_management_suite12.2.1.3.0 – 12.2.1.3.0
oracle / business_process_management_suite12.2.1.4.0 – 12.2.1.4.0
oracle / commerce_guided_search11.3.2 – 11.3.2
oracle / communications_billing_and_revenue_management12.0.0.4 – 12.0.0.4
oracle / communications_cloud_native_core_service_communication_proxy1.14.0 – 1.14.0
oracle / communications_cloud_native_core_unified_data_repository1.14.0 – 1.14.0
oracle / communications_diameter_intelligence_hub8.0.0 – 8.2.3
oracle / communications_messaging_server8.1 – 8.1
oracle / communications_session_route_manager8.0.0 – 8.2.5
oracle / financial_services_crime_and_compliance_management_studio8.0.8.3.0 – 8.0.8.3.0
oracle / financial_services_crime_and_compliance_management_studio8.0.8.2.0 – 8.0.8.2.0
oracle / financial_services_enterprise_case_management8.0.8.1.0 – 8.0.8.1.0
oracle / financial_services_enterprise_case_management8.0.7.2.0 – 8.0.7.2.0
oracle / FLEXCUBE Universal Banking12.4 – 12.4
oracle / FLEXCUBE Universal Banking14.5 – 14.5
oracle / FLEXCUBE Universal Banking14.0.0 – 14.3.0
oracle / healthcare_data_repository8.1.0 – 8.1.0
oracle / insurance_policy_administration11.1.0 – 11.1.0
oracle / insurance_policy_administration11.2.8 – 11.2.8
oracle / insurance_policy_administration11.3.0 – 11.3.0
oracle / insurance_policy_administration11.3.1 – 11.3.1
oracle / insurance_policy_administration11.0.2 – 11.0.2
oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
oracle / peoplesoft_enterprise_peopletools8.59 – 8.59
oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
oracle / primavera_unifier18.8 – 18.8
oracle / primavera_unifier19.12 – 19.12
oracle / primavera_unifier20.12 – 20.12
oracle / primavera_unifier17.7 – 17.12
oracle / utilities_testing_accelerator6.0.0.2.2 – 6.0.0.2.2
oracle / utilities_testing_accelerator6.0.0.3.1 – 6.0.0.3.1
oracle / utilities_testing_accelerator6.0.0.1.1 – 6.0.0.1.1
oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0

References

Updated 25m ago · 8 sources