Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-35517

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Published

2021-07-13T08:15:07.220

Last Modified

2024-11-21T06:12:25.653

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-130
  • Type: Primary
    CWE-770
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache commons_compress ≤ 1.20 Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
Application netapp oncommand_insight - Yes
Application oracle banking_apis ≤ 18.3 Yes
Application oracle banking_apis 19.1 Yes
Application oracle banking_apis 19.2 Yes
Application oracle banking_apis 20.1 Yes
Application oracle banking_apis 21.1 Yes
Application oracle banking_digital_experience ≤ 18.3 Yes
Application oracle banking_digital_experience 19.1 Yes
Application oracle banking_digital_experience 19.2 Yes
Application oracle banking_digital_experience 20.1 Yes
Application oracle banking_digital_experience 21.1 Yes
Application oracle banking_enterprise_default_management 2.7.0 Yes
Application oracle banking_party_management 2.7.0 Yes
Application oracle banking_payments 14.5 Yes
Application oracle banking_trade_finance 14.5 Yes
Application oracle banking_treasury_management 14.5 Yes
Application oracle business_process_management_suite 12.2.1.3.0 Yes
Application oracle business_process_management_suite 12.2.1.4.0 Yes
Application oracle commerce_guided_search 11.3.2 Yes
Application oracle communications_billing_and_revenue_management 12.0.0.4 Yes
Application oracle communications_cloud_native_core_service_communication_proxy 1.14.0 Yes
Application oracle communications_cloud_native_core_unified_data_repository 1.14.0 Yes
Application oracle communications_diameter_intelligence_hub ≤ 8.2.3 Yes
Application oracle communications_session_route_manager ≤ 8.2.5 Yes
Application oracle financial_services_crime_and_compliance_management_studio 8.0.8.2.0 Yes
Application oracle financial_services_crime_and_compliance_management_studio 8.0.8.3.0 Yes
Application oracle financial_services_enterprise_case_management 8.0.7.2.0 Yes
Application oracle financial_services_enterprise_case_management 8.0.8.1.0 Yes
Application oracle flexcube_universal_banking ≤ 14.3.0 Yes
Application oracle flexcube_universal_banking 12.4 Yes
Application oracle flexcube_universal_banking 14.5 Yes
Application oracle healthcare_data_repository 8.1.0 Yes
Application oracle insurance_policy_administration 11.0.2 Yes
Application oracle insurance_policy_administration 11.1.0 Yes
Application oracle insurance_policy_administration 11.2.8 Yes
Application oracle insurance_policy_administration 11.3.0 Yes
Application oracle insurance_policy_administration 11.3.1 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Application oracle primavera_unifier ≤ 17.12 Yes
Application oracle primavera_unifier 18.8 Yes
Application oracle primavera_unifier 19.12 Yes
Application oracle primavera_unifier 20.12 Yes
Application oracle utilities_testing_accelerator 6.0.0.1.1 Yes
Application oracle utilities_testing_accelerator 6.0.0.2.2 Yes
Application oracle utilities_testing_accelerator 6.0.0.3.1 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
Application oracle webcenter_portal 12.2.1.4.0 Yes
Operating System oracle communications_messaging_server 8.1 Yes
References