NetSight
IP …
high7.5

CVE-2021-35516

Improper Handling of Length Parameter Inconsistency in Compress

Impact

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.commons:commons-compress< 1.211.21

Affected products

VendorProductAffected versions
ApacheCommons Compress
from 1.6 through 1.20
NetappActive Iq Unified Manager
All versions
NetappOncommand Insight
All versions
OracleBanking Digital Experience
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Enterprise Default Management
Version 2.7.0
OracleBanking Party Management
Version 2.7.0
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Billing And Revenue Management
Version 12.0.0.4
OracleCommunications Cloud Native Core Automated Test Suite
Version 1.8.0
OracleCommunications Cloud Native Core Service Communication Proxy
Version 1.14.0
OracleCommunications Cloud Native Core Unified Data Repository
Version 1.14.0

Weakness classification

CWE-130CWE-770

References