CVE-2021-36090

HIGH7.5

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products

apache / commons_compress1.0 – 1.21
Apache Software Foundation / Apache Commons CompressApache Commons Compress – 1.20
NetApp / active_iq_unified_manager
NetApp / active_iq_unified_manager
NetApp / active_iq_unified_manager
NetApp / OnCommand Insight
oracle / banking_apis18.1 – 18.3
oracle / banking_apis20.1 – 20.1
oracle / banking_apis21.1 – 21.1
oracle / banking_apis19.1 – 19.1
oracle / banking_apis19.2 – 19.2
oracle / banking_digital_experience21.1 – 21.1
oracle / banking_digital_experience18.1 – 18.3
oracle / banking_digital_experience19.1 – 19.1
oracle / banking_digital_experience19.2 – 19.2
oracle / banking_digital_experience20.1 – 20.1
oracle / banking_enterprise_default_management2.7.0 – 2.7.0
oracle / banking_party_management2.7.0 – 2.7.0
oracle / banking_payments14.5 – 14.5
oracle / banking_platform2.7.1 – 2.7.1
oracle / banking_platform2.9.0 – 2.9.0
oracle / banking_platform2.12.0 – 2.12.0
oracle / banking_platform2.6.2 – 2.6.2
oracle / banking_trade_finance14.5 – 14.5
oracle / banking_treasury_management14.5 – 14.5
oracle / business_process_management_suite12.2.1.4.0 – 12.2.1.4.0
oracle / business_process_management_suite12.2.1.3.0 – 12.2.1.3.0
oracle / commerce_guided_search11.3.2 – 11.3.2
oracle / communications_billing_and_revenue_management12.0.0.4 – 12.0.0.4
oracle / communications_cloud_native_core_automated_test_suite1.8.0 – 1.8.0
oracle / communications_cloud_native_core_service_communication_proxy1.14.0 – 1.14.0
oracle / communications_cloud_native_core_unified_data_repository1.14.0 – 1.14.0
oracle / communications_diameter_intelligence_hub8.2.3 – 8.2.3
oracle / communications_diameter_intelligence_hub8.0.0 – 8.2.3
oracle / communications_element_manager8.2.0 – 8.2.4.0
oracle / communications_messaging_server8.1 – 8.1
oracle / communications_session_report_manager8.2.0 – 8.2.5.0
oracle / communications_session_route_manager8.0.0 – 8.2.5.0
oracle / communications_unified_inventory_management7.4.2 – 7.4.2
oracle / communications_unified_inventory_management7.4.0 – 7.4.0
oracle / communications_unified_inventory_management7.4.1 – 7.4.1
oracle / communications_unified_inventory_management7.5.0 – 7.5.0
oracle / financial_services_analytical_applications_infrastructure8.0.6 – 8.1.1
oracle / financial_services_crime_and_compliance_management_studio8.0.8.3.0 – 8.0.8.3.0
oracle / financial_services_crime_and_compliance_management_studio8.0.8.2.0 – 8.0.8.2.0
oracle / financial_services_enterprise_case_management8.0.8.1.0 – 8.0.8.1.0
oracle / financial_services_enterprise_case_management8.0.7.2.0 – 8.0.7.2.0
oracle / financial_services_enterprise_case_management
oracle / FLEXCUBE Universal Banking14.5 – 14.5
oracle / FLEXCUBE Universal Banking14.0.0 – 14.3.0
oracle / FLEXCUBE Universal Banking12.4 – 12.4
oracle / healthcare_data_repository8.1.0 – 8.1.0
oracle / insurance_policy_administration11.1.0 – 11.1.0
oracle / insurance_policy_administration11.2.8 – 11.2.8
oracle / insurance_policy_administration11.3.0 – 11.3.0
oracle / insurance_policy_administration11.3.1 – 11.3.1
oracle / insurance_policy_administration11.0.2 – 11.0.2
oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
oracle / peoplesoft_enterprise_peopletools8.59 – 8.59
oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
oracle / primavera_gateway17.12.0 – 17.12.11
oracle / primavera_unifier18.8 – 18.8
oracle / primavera_unifier19.12 – 19.12
oracle / primavera_unifier20.12 – 20.12
oracle / primavera_unifier17.7 – 17.12
oracle / utilities_testing_accelerator6.0.0.3.1 – 6.0.0.3.1
oracle / utilities_testing_accelerator6.0.0.2.2 – 6.0.0.2.2
oracle / utilities_testing_accelerator6.0.0.1.1 – 6.0.0.1.1
oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0

References

Updated 25m ago · 8 sources