7.5

CVE-2021-37136

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

Data is provided by the National Vulnerability Database (NVD)
Netty ≫ Netty Version < 4.1.68
Quarkus ≫ Quarkus Version < 2.2.4
Oracle ≫ Banking Apis Version >= 18.1 <= 18.3
Oracle ≫ Banking Apis Version19.1
Oracle ≫ Banking Apis Version19.2
Oracle ≫ Banking Apis Version20.1
Oracle ≫ Banking Apis Version21.1
Oracle ≫ Coherence Version12.2.1.4.0
Oracle ≫ Coherence Version14.1.1.0.0
Oracle ≫ Commerce Guided Search Version11.3.2
Oracle ≫ Communications Diameter Signaling Router Version >= 8.0.0.0 <= 8.5.0.2
Oracle ≫ Helidon Version1.4.10
Oracle ≫ Helidon Version2.4.0
Oracle ≫ Webcenter Portal Version12.2.1.3.0
Oracle ≫ Webcenter Portal Version12.2.1.4.0
Netapp ≫ Oncommand Insight Version-
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.23% 0.429
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.