CVE-2021-35515
13.07.2021, 08:15
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
| Vendor | Product | Version |
|---|---|---|
| apache | commons_compress | 1.6 ≤ 𝑥 ≤ 1.20 |
| netapp | active_iq_unified_manager | - |
| netapp | active_iq_unified_manager | - |
| netapp | active_iq_unified_manager | - |
| netapp | oncommand_insight | - |
| oracle | banking_digital_experience | 18.1 ≤ 𝑥 ≤ 18.3 |
| oracle | banking_digital_experience | 19.1 |
| oracle | banking_digital_experience | 20.1 |
| oracle | banking_digital_experience | 21.1 |
| oracle | banking_enterprise_default_management | 2.7.0 |
| oracle | banking_party_management | 2.7.0 |
| oracle | banking_payments | 14.5 |
| oracle | banking_trade_finance | 14.5 |
| oracle | banking_treasury_management | 14.5 |
| oracle | business_process_management_suite | 12.2.1.3.0 |
| oracle | business_process_management_suite | 12.2.1.4.0 |
| oracle | commerce_guided_search | 11.3.2 |
| oracle | communications_billing_and_revenue_management | 12.0.0.4 |
| oracle | communications_cloud_native_core_automated_test_suite | 1.8.0 |
| oracle | communications_cloud_native_core_service_communication_proxy | 1.14.0 |
| oracle | communications_cloud_native_core_unified_data_repository | 1.14.0 |
| oracle | communications_diameter_intelligence_hub | 8.0.0 ≤ 𝑥 ≤ 8.2.3 |
| oracle | communications_session_route_manager | 8.0.0 ≤ 𝑥 ≤ 8.2.5 |
| oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.2.0 |
| oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.3.0 |
| oracle | financial_services_enterprise_case_management | 8.0.7.2.0 |
| oracle | financial_services_enterprise_case_management | 8.0.8.1.0 |
| oracle | flexcube_universal_banking | 14.0.0 ≤ 𝑥 ≤ 14.3.0 |
| oracle | flexcube_universal_banking | 12.4.0 |
| oracle | flexcube_universal_banking | 14.5.0 |
| oracle | healthcare_data_repository | 8.1.0 |
| oracle | insurance_policy_administration | 11.0.2 |
| oracle | insurance_policy_administration | 11.1.0 |
| oracle | insurance_policy_administration | 11.2.8 |
| oracle | insurance_policy_administration | 11.3.0 |
| oracle | insurance_policy_administration | 11.3.1 |
| oracle | peoplesoft_enterprise_peopletools | 8.57 |
| oracle | peoplesoft_enterprise_peopletools | 8.58 |
| oracle | peoplesoft_enterprise_peopletools | 8.59 |
| oracle | primavera_unifier | 17.7 ≤ 𝑥 ≤ 17.12 |
| oracle | primavera_unifier | 18.8 |
| oracle | primavera_unifier | 19.12 |
| oracle | primavera_unifier | 20.12 |
| oracle | utilities_testing_accelerator | 6.0.0.1.1 |
| oracle | utilities_testing_accelerator | 6.0.0.2.2 |
| oracle | utilities_testing_accelerator | 6.0.0.3.1 |
| oracle | communications_messaging_server | 8.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-834 - Excessive IterationThe software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References