NetSight
IP …
high7.5

CVE-2021-35517

Improper Handling of Length Parameter Inconsistency in Compress

Impact

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.commons:commons-compress< 1.211.21

Affected products

VendorProductAffected versions
ApacheCommons Compress
from 1.1 through 1.20
NetappActive Iq Unified Manager
All versions
NetappOncommand Insight
All versions
OracleBanking Apis
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Digital Experience
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Enterprise Default Management
Version 2.7.0
OracleBanking Party Management
Version 2.7.0
OracleBanking Payments
Version 14.5
OracleBanking Trade Finance
Version 14.5
OracleBanking Treasury Management
Version 14.5
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommerce Guided Search
Version 11.3.2

Weakness classification

CWE-130CWE-770

References