7.5
CVE-2021-37136
- EPSS 5.91%
- Veröffentlicht 19.10.2021 15:15:07
- Zuletzt bearbeitet 21.11.2024 06:14:42
- Erkennungen
LoginThe Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Banking Apis Version >= 18.1 <= 18.3
Oracle ≫ Banking Apis Version 19.1
Oracle ≫ Banking Apis Version 19.2
Oracle ≫ Banking Apis Version 20.1
Oracle ≫ Banking Apis Version 21.1
Oracle ≫ Banking Digital Experience Version 18.1
Oracle ≫ Banking Digital Experience Version 18.2
Oracle ≫ Banking Digital Experience Version 18.3
Oracle ≫ Banking Digital Experience Version 19.1
Oracle ≫ Banking Digital Experience Version 19.2
Oracle ≫ Banking Digital Experience Version 20.1
Oracle ≫ Banking Digital Experience Version 21.1
Oracle ≫ Commerce Guided Search Version 11.3.2
Oracle ≫ Communications Brm - Elastic Charging Engine Version < 12.0.0.4.6
Oracle ≫ Communications Brm - Elastic Charging Engine Version 12 Update 0.0.5.0
Oracle ≫ Communications Cloud Native Core Binding Support Function Version 1.10.0
Oracle ≫ Communications Cloud Native Core Binding Support Function Version 1.11.0
Oracle ≫ Communications Cloud Native Core Policy Version 1.15.0
Oracle ≫ Communications Cloud Native Core Unified Data Repository Version 1.15.0
Oracle ≫ Communications Diameter Signaling Router Version >= 8.0.0.0 <= 8.5.0.2
Oracle ≫ Communications Instant Messaging Server Version 8.1
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.48
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.57
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.58
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.59
Oracle ≫ Webcenter Portal Version 12.2.1.3.0
Oracle ≫ Webcenter Portal Version 12.2.1.4.0
Netapp ≫ Oncommand Insight Version -
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 5.91% | 0.926 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| NIST | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E
https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3E
https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
https://security.netapp.com/advisory/ntap-20220210-0012/
https://www.debian.org/security/2023/dsa-5316