Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-36090

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Published

2021-07-13T08:15:07.310

Last Modified

2024-11-21T06:13:08.120

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-130
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache commons_compress < 1.21 Yes
Application oracle banking_apis ≤ 18.3 Yes
Application oracle banking_apis 19.1 Yes
Application oracle banking_apis 19.2 Yes
Application oracle banking_apis 20.1 Yes
Application oracle banking_apis 21.1 Yes
Application oracle banking_digital_experience ≤ 18.3 Yes
Application oracle banking_digital_experience 19.1 Yes
Application oracle banking_digital_experience 19.2 Yes
Application oracle banking_digital_experience 20.1 Yes
Application oracle banking_digital_experience 21.1 Yes
Application oracle banking_enterprise_default_management 2.7.0 Yes
Application oracle banking_party_management 2.7.0 Yes
Application oracle banking_payments 14.5 Yes
Application oracle banking_platform 2.6.2 Yes
Application oracle banking_platform 2.7.1 Yes
Application oracle banking_platform 2.9.0 Yes
Application oracle banking_platform 2.12.0 Yes
Application oracle banking_trade_finance 14.5 Yes
Application oracle banking_treasury_management 14.5 Yes
Application oracle business_process_management_suite 12.2.1.3.0 Yes
Application oracle business_process_management_suite 12.2.1.4.0 Yes
Application oracle commerce_guided_search 11.3.2 Yes
Application oracle communications_billing_and_revenue_management 12.0.0.4 Yes
Application oracle communications_cloud_native_core_automated_test_suite 1.8.0 Yes
Application oracle communications_cloud_native_core_service_communication_proxy 1.14.0 Yes
Application oracle communications_cloud_native_core_unified_data_repository 1.14.0 Yes
Application oracle communications_diameter_intelligence_hub ≤ 8.2.3 Yes
Application oracle communications_diameter_intelligence_hub 8.2.3 Yes
Application oracle communications_element_manager ≤ 8.2.4.0 Yes
Application oracle communications_session_report_manager ≤ 8.2.5.0 Yes
Application oracle communications_session_route_manager ≤ 8.2.5.0 Yes
Application oracle communications_unified_inventory_management 7.4.0 Yes
Application oracle communications_unified_inventory_management 7.4.1 Yes
Application oracle communications_unified_inventory_management 7.4.2 Yes
Application oracle communications_unified_inventory_management 7.5.0 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.1.1 Yes
Application oracle financial_services_crime_and_compliance_management_studio 8.0.8.2.0 Yes
Application oracle financial_services_crime_and_compliance_management_studio 8.0.8.3.0 Yes
Application oracle financial_services_enterprise_case_management * Yes
Application oracle financial_services_enterprise_case_management 8.0.7.2.0 Yes
Application oracle financial_services_enterprise_case_management 8.0.8.1.0 Yes
Application oracle flexcube_universal_banking ≤ 14.3.0 Yes
Application oracle flexcube_universal_banking 12.4 Yes
Application oracle flexcube_universal_banking 14.5 Yes
Application oracle healthcare_data_repository 8.1.0 Yes
Application oracle insurance_policy_administration 11.0.2 Yes
Application oracle insurance_policy_administration 11.1.0 Yes
Application oracle insurance_policy_administration 11.2.8 Yes
Application oracle insurance_policy_administration 11.3.0 Yes
Application oracle insurance_policy_administration 11.3.1 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Application oracle primavera_gateway ≤ 17.12.11 Yes
Application oracle primavera_gateway ≤ 18.8.12 Yes
Application oracle primavera_gateway ≤ 19.12.11 Yes
Application oracle primavera_gateway ≤ 20.12.7 Yes
Application oracle primavera_unifier ≤ 17.12 Yes
Application oracle primavera_unifier 18.8 Yes
Application oracle primavera_unifier 19.12 Yes
Application oracle primavera_unifier 20.12 Yes
Application oracle utilities_testing_accelerator 6.0.0.1.1 Yes
Application oracle utilities_testing_accelerator 6.0.0.2.2 Yes
Application oracle utilities_testing_accelerator 6.0.0.3.1 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
Application oracle webcenter_portal 12.2.1.4.0 Yes
Operating System oracle communications_messaging_server 8.1 Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
Application netapp oncommand_insight - Yes
References