CVE-2021-35516 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
Attackers can cause denial of service by providing crafted 7Z archives that trigger excessive memory allocation in Apache Commons Compress.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-35516?
CVE-2021-35516 is a high-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 13 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Which versions are affected by CVE-2021-35516?
2 open source packages ship an affected version, including org.apache.commons:commons-compress. It affects 24 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-compress Maven | All versions | 1.21 |
org.apache.commons:commons-compress Maven | All versions | 1.21 |
Products include Apache Commons Compress, Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Oracle Banking Digital Experience, Oracle Banking Enterprise Default Management, Oracle Banking Party Management and 18 more.
How do I fix CVE-2021-35516?
Upgrade org.apache.commons:commons-compress to 1.21 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-35516 being exploited?
There is no known exploitation of CVE-2021-35516 in the wild and no public exploit code.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
- CVE-2021-35515 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- CVE-2021-35517 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
- CVE-2021-36090 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
- CVE-2019-12402 Denial of Service in Apache Commons Compress
Sources
Also known as AZL-45144, DEBIAN-CVE-2021-35516, GHSA-crv7-7245-f45f, MINI-v4p2-fwr3-898r, ROOT-APP-MAVEN-CVE-2021-35516, UBUNTU-CVE-2021-35516.