CVE-2021-35517 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
Attackers can cause denial of service by triggering excessive memory allocation via crafted TAR archives in Apache Commons Compress.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-35517?
CVE-2021-35517 is a high-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 13 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Which versions are affected by CVE-2021-35517?
2 open source packages ship an affected version, including org.apache.commons:commons-compress. It affects 27 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-compress Maven | All versions | 1.21 |
org.apache.commons:commons-compress Maven | All versions | 1.21 |
Products include Apache Commons Compress, Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Oracle Banking Apis, Oracle Banking Digital Experience, Oracle Banking Enterprise Default Management and 21 more.
How do I fix CVE-2021-35517?
Upgrade org.apache.commons:commons-compress to 1.21 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-35517 being exploited?
There is no known exploitation of CVE-2021-35517 in the wild and no public exploit code.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
- CVE-2021-35515 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- CVE-2021-35516 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- CVE-2021-36090 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
- CVE-2019-12402 Denial of Service in Apache Commons Compress
Sources
Also known as AZL-44490, DEBIAN-CVE-2021-35517, GHSA-xqfj-vm6h-2x34, MINI-gcmg-xm3j-cfv6, ROOT-APP-MAVEN-CVE-2021-35517, UBUNTU-CVE-2021-35517.