Improper Handling of Length Parameter Inconsistency in Compress

ALTO 7.5CVE-2021-35516 · GHSA-crv7-7245-f45f · Published 13/07/2021 · updated 17/06/2026

Em resumo

CVE-2021-35516 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta org.apache.commons:commons-compress, commons compress (apache), banking digital experience (oracle).
Chance de exploração nos próximos 30 dias (EPSS): 12.4%, maior que 96.2% das vulnerabilidades.
Correção: atualize para 1.21 ou posterior.

Package	Affected versions	Patched versions
org.apache.commons:commons-compress Maven	`< 1.21`	`1.21`
commons compress apache	`≥ 1.6, ≤ 1.20`	No fix yet
banking digital experience oracle	`= 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3`	No fix yet
banking enterprise default management oracle	`= 2.7.0`	No fix yet
banking party management oracle	`= 2.7.0`	No fix yet
business process management suite oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
commerce guided search oracle	`= 11.3.2`	No fix yet
communications billing and revenue management oracle	`= 12.0.0.4`	No fix yet
communications cloud native core automated test suite oracle	`= 1.8.0`	No fix yet
communications cloud native core service communication proxy oracle	`= 1.14.0`	No fix yet
communications cloud native core unified data repository oracle	`= 1.14.0`	No fix yet
communications diameter intelligence hub oracle	`≥ 8.0.0, ≤ 8.2.3`	No fix yet
communications session route manager oracle	`≥ 8.0.0, ≤ 8.2.5`	No fix yet
financial services crime and compliance management studio oracle	`= 8.0.8.2.0= 8.0.8.3.0`	No fix yet
financial services enterprise case management oracle	`= 8.0.7.2.0= 8.0.8.1.0`	No fix yet
flexcube universal banking oracle	`= 12.4.0= 14.5≥ 14.0.0, ≤ 14.3.0`	No fix yet
healthcare data repository oracle	`= 8.1.0`	No fix yet
insurance policy administration oracle	`= 11.0.2= 11.1.0= 11.2.8= 11.3.0= 11.3.1`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.57= 8.58= 8.59`	No fix yet
primavera unifier oracle	`= 18.8= 19.12= 20.12≥ 17.7, ≤ 17.12`	No fix yet
utilities testing accelerator oracle	`= 6.0.0.1.1= 6.0.0.2.2= 6.0.0.3.1`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

NVD description

References

Mais vulnerabilidades de org.apache.commons:commons-compress

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free