7.5
CVE-2021-35516
- EPSS 12.37%
- Veröffentlicht 13.07.2021 08:15:07
- Zuletzt bearbeitet 21.11.2024 06:12:25
- Erkennungen
LoginApache Commons Compress 1.6 to 1.20 denial of service vulnerability
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Commons Compress Version >= 1.6 <= 1.20
Netapp ≫ Active Iq Unified Manager Version - SwPlatform linux
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows
Netapp ≫ Oncommand Insight Version -
Oracle ≫ Banking Digital Experience Version >= 18.1 <= 18.3
Oracle ≫ Banking Digital Experience Version 19.1
Oracle ≫ Banking Digital Experience Version 19.2
Oracle ≫ Banking Digital Experience Version 20.1
Oracle ≫ Banking Digital Experience Version 21.1
Oracle ≫ Banking Enterprise Default Management Version 2.7.0
Oracle ≫ Banking Party Management Version 2.7.0
Oracle ≫ Business Process Management Suite Version 12.2.1.3.0
Oracle ≫ Business Process Management Suite Version 12.2.1.4.0
Oracle ≫ Commerce Guided Search Version 11.3.2
Oracle ≫ Communications Billing And Revenue Management Version 12.0.0.4
Oracle ≫ Communications Cloud Native Core Automated Test Suite Version 1.8.0
Oracle ≫ Communications Cloud Native Core Service Communication Proxy Version 1.14.0
Oracle ≫ Communications Cloud Native Core Unified Data Repository Version 1.14.0
Oracle ≫ Communications Diameter Intelligence Hub Version >= 8.0.0 <= 8.2.3
Oracle ≫ Communications Session Route Manager Version >= 8.0.0 <= 8.2.5
Oracle ≫ Financial Services Crime And Compliance Management Studio Version 8.0.8.2.0
Oracle ≫ Financial Services Crime And Compliance Management Studio Version 8.0.8.3.0
Oracle ≫ Financial Services Enterprise Case Management Version 8.0.7.2.0
Oracle ≫ Financial Services Enterprise Case Management Version 8.0.8.1.0
Oracle ≫ Flexcube Universal Banking Version >= 14.0.0 <= 14.3.0
Oracle ≫ Flexcube Universal Banking Version 12.4.0
Oracle ≫ Flexcube Universal Banking Version 14.5
Oracle ≫ Healthcare Data Repository Version 8.1.0
Oracle ≫ Insurance Policy Administration Version 11.0.2
Oracle ≫ Insurance Policy Administration Version 11.1.0
Oracle ≫ Insurance Policy Administration Version 11.2.8
Oracle ≫ Insurance Policy Administration Version 11.3.0
Oracle ≫ Insurance Policy Administration Version 11.3.1
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.57
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.58
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.59
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version 18.8
Oracle ≫ Primavera Unifier Version 19.12
Oracle ≫ Primavera Unifier Version 20.12
Oracle ≫ Utilities Testing Accelerator Version 6.0.0.1.1
Oracle ≫ Utilities Testing Accelerator Version 6.0.0.2.2
Oracle ≫ Utilities Testing Accelerator Version 6.0.0.3.1
Oracle ≫ Webcenter Portal Version 12.2.1.3.0
Oracle ≫ Webcenter Portal Version 12.2.1.4.0
Oracle ≫ Communications Messaging Server Version 8.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 12.37% | 0.957 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| NIST | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
CWE-130 Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://commons.apache.org/proper/commons-compress/security-reports.html
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E
https://security.netapp.com/advisory/ntap-20211022-0001/
http://www.openwall.com/lists/oss-security/2021/07/13/2
https://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91%40%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E