NetSight
IP …
high7.5

CVE-2021-36090

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for ve…

Impact

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Affected products

VendorProductAffected versions
ApacheCommons Compress
from 1.0 before 1.21
OracleBanking Apis
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Digital Experience
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Enterprise Default Management
Version 2.7.0
OracleBanking Party Management
Version 2.7.0
OracleBanking Payments
Version 14.5
OracleBanking Platform
Versions 2.6.2, 2.7.1, 2.9.0, 2.12.0
OracleBanking Trade Finance
Version 14.5
OracleBanking Treasury Management
Version 14.5
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Billing And Revenue Management
Version 12.0.0.4

Weakness classification

CWE-130

References