CVE-2021-35516
published 2021-07-13CVE-2021-35516: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
12.37%
96.2th percentile
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons_compress | 1.6 – 1.20 | — |
| apache_software_foundation | apache_commons_compress | >= 1.6 < Apache Commons Compress* | Apache Commons Compress* |
| atlassian | confluence_data_center | — | — |
| debian | libcommons-compress-java | < libcommons-compress-java 1.21-1 (bookworm) | libcommons-compress-java 1.21-1 (bookworm) |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | 18.1 – 18.3 | — |
| oracle | banking_enterprise_default_management | — | — |
| oracle | banking_party_management | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | commerce_guided_search | — | — |
| oracle | communications_billing_and_revenue_management | — | — |
| oracle | communications_cloud_native_core_automated_test_suite | — | — |
| oracle | communications_cloud_native_core_service_communication_proxy | — | — |
| oracle | communications_cloud_native_core_unified_data_repository | — | — |
| oracle | communications_diameter_intelligence_hub | 8.0.0 – 8.2.3 | — |
| oracle | communications_messaging_server | — | — |
| oracle | communications_session_route_manager | 8.0.0 – 8.2.5 | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_enterprise_case_management | — | — |
| oracle | financial_services_enterprise_case_management | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Atlassian
CVE-2021-35516: DoS (Denial of Service) org.apache.commons:commons-compress Dependency in Confluence Data Center and Server
vendor_atlassian·2024-07-16·CVSS 7.5
CVE-2021-35516 [HIGH] CVE-2021-35516: DoS (Denial of Service) org.apache.commons:commons-compress Dependency in Confluence Data Center and Server
CVE-2021-35516: DoS (Denial of Service) org.apache.commons:commons-compress Dependency in Confluence Data Center and Server
DoS (Denial of Service) org.apache.commons:commons-compress Dependency in Confluence Data Center and Server
CVE: CVE-2021-35516
Affected products: Confluence Data Center
Red Hat
apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive
vendor_redhat·2021-07-13·CVSS 7.5
CVE-2021-35516 [HIGH] CWE-770 apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive
apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for very small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' SevenZ package. The highest threat from this vulnerability is to system availability.
Package: apache-commons-compress (Red Ha
Debian
CVE-2021-35516: libcommons-compress-java - When reading a specially crafted 7Z archive, Compress can be made to allocate la...
vendor_debian·2021·CVSS 7.5
CVE-2021-35516 [HIGH] CVE-2021-35516: libcommons-compress-java - When reading a specially crafted 7Z archive, Compress can be made to allocate la...
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Scope: local
bookworm: resolved (fixed in 1.21-1)
bullseye: open
forky: resolved (fixed in 1.21-1)
sid: resolved (fixed in 1.21-1)
trixie: resolved (fixed in 1.21-1)
OSV
Improper Handling of Length Parameter Inconsistency in Compress
osv·2021-08-02
CVE-2021-35516 [HIGH] Improper Handling of Length Parameter Inconsistency in Compress
Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
GHSA
Improper Handling of Length Parameter Inconsistency in Compress
ghsa·2021-08-02
CVE-2021-35516 [HIGH] CWE-130 Improper Handling of Length Parameter Inconsistency in Compress
Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
OSV
CVE-2021-35516: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error eve
osv·2021-07-13·CVSS 7.5
CVE-2021-35516 [HIGH] CVE-2021-35516: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error eve
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2021-35516 apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive
bugzilla·2021-07-13·CVSS 7.5
CVE-2021-35516 [HIGH] CVE-2021-35516 apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive
CVE-2021-35516 apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
References:
https://commons.apache.org/proper/commons-compress/security-reports.html
https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E
http://www.openwall.com/lists/oss-security/2021/07/13/2
Discussion:
Created apache-commons-compress tracking bugs for this issue:
Affects: fedora-all [bug 1981901]
Created javapackages-bo
Tenable
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
blogs_tenable·2022-04-20
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Oracle October 2021 Critical Patch Update Addresses 231 CVEs
blogs_tenable·2021-10-20
Oracle October 2021 Critical Patch Update Addresses 231 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
arXiv
Security Review of Ethereum Beacon Clients
arxiv_fulltext·2021-09-23
Security Review of Ethereum Beacon Clients
center
[width=7cm]beacon
empty
1cm
Security Review of Ethereum Beacon Clients
1cm
JP Aumasson -- Taurus, Switzerland -- [email protected],
Denis Kolegov -- Tomsk State University, Russia -- [email protected]
Evangelia Stathopoulou -- University College London, UK -- [email protected]
0.5cm
Version
0.5cm
Supported by the Ethereum Foundation.
center
## Abstract
The beacon chain is the backbone of the Ethereum's evolution
towards a proof-of-stake-based scalable network.
Beacon clients are the applications implementing the services
required to operate the beacon chain, namely validators, beacon
nodes, and slashers.
Security defects in beacon clients could lead to loss of funds,
consensus rules violation, network congestion, and other
inconveniences.
We repo
http://www.openwall.com/lists/oss-security/2021/07/13/2https://commons.apache.org/proper/commons-compress/security-reports.htmlhttps://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3Ehttps://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3Ehttps://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20211022-0001/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://www.openwall.com/lists/oss-security/2021/07/13/2https://commons.apache.org/proper/commons-compress/security-reports.htmlhttps://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3Ehttps://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3Ehttps://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3Ehttps://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20211022-0001/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-07-13
Published