CVE Feed

    Dashboard / CVE / CVE-2021-36090

    CVE-2021-36090

    When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

    Published:Jul 13, 2021
    Last Modified:Nov 21, 2024
    EPS:Jul 13, 2021
    EPSS Score:0.00279
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Commons Compress
    Vendor
    Netapp
    Product
    Active Iq Unified Manager
    Vendor
    Netapp
    Product
    Oncommand Insight
    Vendor
    Oracle
    Product
    Banking Apis
    Vendor
    Oracle
    Product
    Banking Digital Experience
    Vendor
    Oracle
    Product
    Banking Enterprise Default Management
    Vendor
    Oracle
    Product
    Banking Party Management
    Vendor
    Oracle
    Product
    Banking Payments
    Vendor
    Oracle
    Product
    Banking Platform
    Vendor
    Oracle
    Product
    Banking Trade Finance
    Vendor
    Oracle
    Product
    Banking Treasury Management
    Vendor
    Oracle
    Product
    Business Process Management Suite
    Vendor
    Oracle
    Product
    Commerce Guided Search
    Vendor
    Oracle
    Product
    Communications Billing And Revenue Management
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Automated Test Suite
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Service Communication Proxy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Unified Data Repository
    Vendor
    Oracle
    Product
    Communications Diameter Intelligence Hub
    Vendor
    Oracle
    Product
    Communications Element Manager
    Vendor
    Oracle
    Product
    Communications Messaging Server
    Vendor
    Oracle
    Product
    Communications Session Report Manager
    Vendor
    Oracle
    Product
    Communications Session Route Manager
    Vendor
    Oracle
    Product
    Communications Unified Inventory Management
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Infrastructure
    Vendor
    Oracle
    Product
    Financial Services Crime And Compliance Management Studio
    Vendor
    Oracle
    Product
    Financial Services Enterprise Case Management
    Vendor
    Oracle
    Product
    Flexcube Universal Banking
    Vendor
    Oracle
    Product
    Healthcare Data Repository
    Vendor
    Oracle
    Product
    Insurance Policy Administration
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Oracle
    Product
    Primavera Gateway
    Vendor
    Oracle
    Product
    Primavera Unifier
    Vendor
    Oracle
    Product
    Utilities Testing Accelerator
    Vendor
    Oracle
    Product
    Webcenter Portal
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Rhev Manager

    Exploits

    https://github.com/dawetmaster/CVE-2021-36090-commons-compress-vulnerable

    Related CVEs

    CVE-2024-25710 (CVSS 8.1) — Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue aff…
    CVE-2024-26308 (CVSS 5.5) — Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affec…
    CVE-2023-42503 (CVSS 5.5) — Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR p…
    CVE-2021-35515 (CVSS 7.5) — When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry c…
    CVE-2021-35516 (CVSS 7.5) — When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that fin…
    CVE-2021-35517 (CVSS 7.5) — When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that fi…
    CVE-2019-12402 (CVSS 7.5) — The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infin…
    CVE-2018-11771 (CVSS 5.5) — When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArch…
    CVE-2018-1324 (CVSS 5.5) — A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra…
    CVE-2012-2098 (CVSS 5) — Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOut…

    References

    http://www.openwall.com/lists/oss-security/2021/07/13/4
    http://www.openwall.com/lists/oss-security/2021/07/13/6
    https://commons.apache.org/proper/commons-compress/security-reports.html
    https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E
    https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E
    https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
    https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E
    https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E
    https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E
    https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E
    https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7%40%3Cnotifications.james.apache.org%3E
    https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E
    https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
    https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E
    https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E
    https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E
    https://security.netapp.com/advisory/ntap-20211022-0001/
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    http://www.openwall.com/lists/oss-security/2021/07/13/4
    http://www.openwall.com/lists/oss-security/2021/07/13/6
    https://commons.apache.org/proper/commons-compress/security-reports.html
    https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E
    https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E
    https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
    https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E
    https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E
    https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E
    https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E
    https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7%40%3Cnotifications.james.apache.org%3E
    https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E
    https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
    https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E
    https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E
    https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E
    https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E
    https://security.netapp.com/advisory/ntap-20211022-0001/
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High