CVE-2021-36090

EPSS 12.95%
Veröffentlicht 13.07.2021 08:15:07
Zuletzt bearbeitet 21.11.2024 06:13:08
Erkennungen
Login

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 37

NVD 72 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Commons Compress Version >= 1.0 < 1.21

Oracle ≫ Banking Apis Version >= 18.1 <= 18.3

Oracle ≫ Banking Apis Version 19.1

Oracle ≫ Banking Apis Version 19.2

Oracle ≫ Banking Apis Version 20.1

Oracle ≫ Banking Apis Version 21.1

Oracle ≫ Banking Digital Experience Version >= 18.1 <= 18.3

Oracle ≫ Banking Digital Experience Version 19.1

Oracle ≫ Banking Digital Experience Version 19.2

Oracle ≫ Banking Digital Experience Version 20.1

Oracle ≫ Banking Digital Experience Version 21.1

Oracle ≫ Banking Enterprise Default Management Version 2.7.0

Oracle ≫ Banking Party Management Version 2.7.0

Oracle ≫ Banking Payments Version 14.5

Oracle ≫ Banking Platform Version 2.6.2

Oracle ≫ Banking Platform Version 2.7.1

Oracle ≫ Banking Platform Version 2.9.0

Oracle ≫ Banking Platform Version 2.12.0

Oracle ≫ Banking Trade Finance Version 14.5

Oracle ≫ Banking Treasury Management Version 14.5

Oracle ≫ Business Process Management Suite Version 12.2.1.3.0

Oracle ≫ Business Process Management Suite Version 12.2.1.4.0

Oracle ≫ Commerce Guided Search Version 11.3.2

Oracle ≫ Communications Billing And Revenue Management Version 12.0.0.4

Oracle ≫ Communications Cloud Native Core Automated Test Suite Version 1.8.0

Oracle ≫ Communications Cloud Native Core Service Communication Proxy Version 1.14.0

Oracle ≫ Communications Cloud Native Core Unified Data Repository Version 1.14.0

Oracle ≫ Communications Diameter Intelligence Hub Version >= 8.0.0 <= 8.2.3

Oracle ≫ Communications Diameter Intelligence Hub Version 8.2.3

Oracle ≫ Communications Element Manager Version >= 8.2.0 <= 8.2.4.0

Oracle ≫ Communications Session Report Manager Version >= 8.2.0 <= 8.2.5.0

Oracle ≫ Communications Session Route Manager Version >= 8.0.0 <= 8.2.5.0

Oracle ≫ Communications Unified Inventory Management Version 7.4.0

Oracle ≫ Communications Unified Inventory Management Version 7.4.1

Oracle ≫ Communications Unified Inventory Management Version 7.4.2

Oracle ≫ Communications Unified Inventory Management Version 7.5.0

Oracle ≫ Financial Services Analytical Applications Infrastructure Version >= 8.0.6 <= 8.1.1

Oracle ≫ Financial Services Crime And Compliance Management Studio Version 8.0.8.2.0

Oracle ≫ Financial Services Crime And Compliance Management Studio Version 8.0.8.3.0

Oracle ≫ Financial Services Enterprise Case Management

Oracle ≫ Financial Services Enterprise Case Management Version 8.0.7.2.0

Oracle ≫ Financial Services Enterprise Case Management Version 8.0.8.1.0

Oracle ≫ Flexcube Universal Banking Version >= 14.0.0 <= 14.3.0

Oracle ≫ Flexcube Universal Banking Version 12.4

Oracle ≫ Flexcube Universal Banking Version 14.5

Oracle ≫ Healthcare Data Repository Version 8.1.0

Oracle ≫ Insurance Policy Administration Version 11.0.2

Oracle ≫ Insurance Policy Administration Version 11.1.0

Oracle ≫ Insurance Policy Administration Version 11.2.8

Oracle ≫ Insurance Policy Administration Version 11.3.0

Oracle ≫ Insurance Policy Administration Version 11.3.1

Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.57

Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.58

Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.59

Oracle ≫ Primavera Gateway Version >= 17.12.0 <= 17.12.11

Oracle ≫ Primavera Gateway Version >= 18.8.0 <= 18.8.12

Oracle ≫ Primavera Gateway Version >= 19.12.0 <= 19.12.11

Oracle ≫ Primavera Gateway Version >= 20.12.0 <= 20.12.7

Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12

Oracle ≫ Primavera Unifier Version 18.8

Oracle ≫ Primavera Unifier Version 19.12

Oracle ≫ Primavera Unifier Version 20.12

Oracle ≫ Utilities Testing Accelerator Version 6.0.0.1.1

Oracle ≫ Utilities Testing Accelerator Version 6.0.0.2.2

Oracle ≫ Utilities Testing Accelerator Version 6.0.0.3.1

Oracle ≫ Webcenter Portal Version 12.2.1.3.0

Oracle ≫ Webcenter Portal Version 12.2.1.4.0

Oracle ≫ Communications Messaging Server Version 8.1

Netapp ≫ Active Iq Unified Manager Version - SwPlatform linux

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows

Netapp ≫ Oncommand Insight Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	12.95%	0.959

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-130 Improper Handling of Length Parameter Inconsistency

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

https://www.oracle.com/security-alerts/cpuapr2022.html

Patch

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Patch

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Patch

Third Party Advisory

https://commons.apache.org/proper/commons-compress/security-reports.html

Vendor Advisory

https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E

https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E

https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E

https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E

https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E

https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E

https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E

https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E

https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E

https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E

https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E

https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E

https://security.netapp.com/advisory/ntap-20211022-0001/

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/07/13/4

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2021/07/13/6

Third Party Advisory

Mailing List

https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E

https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E

https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E

https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E

https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7%40%3Cnotifications.james.apache.org%3E

https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E

Vendor Advisory

https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E

https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6%40%3Cissues.drill.apache.org%3E

https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a%40%3Cissues.drill.apache.org%3E

https://nvd.nist.gov/vuln/detail/CVE-2021-36090

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-36090

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-36090

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2021-36090