Improper Handling of Length Parameter Inconsistency in Compress

ÉLEVÉE 7.5CVE-2021-36090 · GHSA-mc84-pj99-q6hh · Published 13/07/2021 · updated 08/10/2026

En bref

CVE-2021-36090 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.apache.commons:commons-compress, commons compress (apache), banking apis (oracle).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 12.9%, plus élevée que 96.3% des vulnérabilités.
Correctif : mettre à jour vers 1.21 ou plus récent.

Package	Affected versions	Patched versions
org.apache.commons:commons-compress Maven	`< 1.21`	`1.21`
commons compress apache	`≥ 1.0, < 1.21`	`1.21`
banking apis oracle	`= 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3`	No fix yet
banking digital experience oracle	`= 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3`	No fix yet
banking enterprise default management oracle	`= 2.7.0`	No fix yet
banking party management oracle	`= 2.7.0`	No fix yet
banking payments oracle	`= 14.5`	No fix yet
banking platform oracle	`= 2.12.0= 2.6.2= 2.7.1= 2.9.0`	No fix yet
banking trade finance oracle	`= 14.5`	No fix yet
banking treasury management oracle	`= 14.5`	No fix yet
business process management suite oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
commerce guided search oracle	`= 11.3.2`	No fix yet
communications billing and revenue management oracle	`= 12.0.0.4`	No fix yet
communications cloud native core automated test suite oracle	`= 1.8.0`	No fix yet
communications cloud native core service communication proxy oracle	`= 1.14.0`	No fix yet
communications cloud native core unified data repository oracle	`= 1.14.0`	No fix yet
communications diameter intelligence hub oracle	`= 8.2.3≥ 8.0.0, ≤ 8.2.3`	No fix yet
communications element manager oracle	`≥ 8.2.0, ≤ 8.2.4.0`	No fix yet
communications session report manager oracle	`≥ 8.2.0, ≤ 8.2.5.0`	No fix yet
communications session route manager oracle	`≥ 8.0.0, ≤ 8.2.5.0`	No fix yet
communications unified inventory management oracle	`= 7.4.0= 7.4.1= 7.4.2= 7.5.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.1.1`	No fix yet
financial services crime and compliance management studio oracle	`= 8.0.8.2.0= 8.0.8.3.0`	No fix yet
financial services enterprise case management oracle	`= 8.0.7.2.0= 8.0.8.1.0`	No fix yet
flexcube universal banking oracle	`= 12.4= 14.5≥ 14.0.0, ≤ 14.3.0`	No fix yet
healthcare data repository oracle	`= 8.1.0`	No fix yet
insurance policy administration oracle	`= 11.0.2= 11.1.0= 11.2.8= 11.3.0= 11.3.1`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.57= 8.58= 8.59`	No fix yet
primavera gateway oracle	`≥ 17.12.0, ≤ 17.12.11≥ 18.8.0, ≤ 18.8.12≥ 19.12.0, ≤ 19.12.11≥ 20.12.0, ≤ 20.12.7`	No fix yet
primavera unifier oracle	`= 18.8= 19.12= 20.12≥ 17.7, ≤ 17.12`	No fix yet
utilities testing accelerator oracle	`= 6.0.0.1.1= 6.0.0.2.2= 6.0.0.3.1`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

NVD description

References

Autres vulnérabilités de org.apache.commons:commons-compress

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free