CVE-2021-35517
13.07.2021, 08:15
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | commons_compress | 1.1 ≤ 𝑥 ≤ 1.20 |
| netapp | active_iq_unified_manager | - |
| netapp | active_iq_unified_manager | - |
| netapp | active_iq_unified_manager | - |
| netapp | oncommand_insight | - |
| oracle | banking_apis | 18.1 ≤ 𝑥 ≤ 18.3 |
| oracle | banking_apis | 19.1 |
| oracle | banking_apis | 19.2 |
| oracle | banking_apis | 20.1 |
| oracle | banking_apis | 21.1 |
| oracle | banking_digital_experience | 18.1 ≤ 𝑥 ≤ 18.3 |
| oracle | banking_digital_experience | 19.1 |
| oracle | banking_digital_experience | 19.2 |
| oracle | banking_digital_experience | 20.1 |
| oracle | banking_digital_experience | 21.1 |
| oracle | banking_enterprise_default_management | 2.7.0 |
| oracle | banking_party_management | 2.7.0 |
| oracle | banking_payments | 14.5 |
| oracle | banking_trade_finance | 14.5 |
| oracle | banking_treasury_management | 14.5 |
| oracle | business_process_management_suite | 12.2.1.3.0 |
| oracle | business_process_management_suite | 12.2.1.4.0 |
| oracle | commerce_guided_search | 11.3.2 |
| oracle | communications_billing_and_revenue_management | 12.0.0.4 |
| oracle | communications_cloud_native_core_service_communication_proxy | 1.14.0 |
| oracle | communications_cloud_native_core_unified_data_repository | 1.14.0 |
| oracle | communications_diameter_intelligence_hub | 8.0.0 ≤ 𝑥 ≤ 8.2.3 |
| oracle | communications_session_route_manager | 8.0.0 ≤ 𝑥 ≤ 8.2.5 |
| oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.2.0 |
| oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.3.0 |
| oracle | financial_services_enterprise_case_management | 8.0.7.2.0 |
| oracle | financial_services_enterprise_case_management | 8.0.8.1.0 |
| oracle | flexcube_universal_banking | 14.0.0 ≤ 𝑥 ≤ 14.3.0 |
| oracle | flexcube_universal_banking | 12.4 |
| oracle | flexcube_universal_banking | 14.5 |
| oracle | healthcare_data_repository | 8.1.0 |
| oracle | insurance_policy_administration | 11.0.2 |
| oracle | insurance_policy_administration | 11.1.0 |
| oracle | insurance_policy_administration | 11.2.8 |
| oracle | insurance_policy_administration | 11.3.0 |
| oracle | insurance_policy_administration | 11.3.1 |
| oracle | peoplesoft_enterprise_peopletools | 8.57 |
| oracle | peoplesoft_enterprise_peopletools | 8.58 |
| oracle | peoplesoft_enterprise_peopletools | 8.59 |
| oracle | primavera_unifier | 17.7 ≤ 𝑥 ≤ 17.12 |
| oracle | primavera_unifier | 18.8 |
| oracle | primavera_unifier | 19.12 |
| oracle | primavera_unifier | 20.12 |
| oracle | utilities_testing_accelerator | 6.0.0.1.1 |
| oracle | utilities_testing_accelerator | 6.0.0.2.2 |
| oracle | utilities_testing_accelerator | 6.0.0.3.1 |
| oracle | webcenter_portal | 12.2.1.3.0 |
| oracle | webcenter_portal | 12.2.1.4.0 |
| oracle | communications_messaging_server | 8.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-130 - Improper Handling of Length Parameter InconsistencyThe software parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-770 - Allocation of Resources Without Limits or ThrottlingThe software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
References