Resource exhaustion in Apache Commons Compress - CVE-2021-36090

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54853

Resource exhaustion in Apache Commons Compress - CVE-2021-36090

Published: July 14, 2021 / Updated: July 29, 2024


Vulnerability identifier: #VU54853
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-36090
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing ZIP archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Apache Commons Compress
IBM Observability with Instana
NovaLink
IBM IoT MessageSight
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Transformation Advisor
Oracle Banking Party Management
Oracle Banking Enterprise Default Management
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM WIoTP MessageGateway
IBM Sterling B2B Integrator
IBM Sterling Control Center
Confluence Data Center
Oracle Communications Unified Inventory Management
Oracle Communications Diameter Intelligence Hub
Oracle Healthcare Data Repository
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Monitor Component
Oracle Middleware Common Libraries and Tools
Oracle Enterprise Data Quality
Middleware Common Libraries and Tools
Oracle Banking Treasury Management
Oracle Banking Trade Finance
Oracle Banking APIs
Oracle Blockchain Platform
Netcool Operations Insight
IBM Process Mining
IBM Spectrum Control
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-ui-extensions (Red Hat package)
ovirt-web-ui (Red Hat package)
ovirt-engine-dwh (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
apache-commons-compress
apache-commons-compress-help
apache-commons-compress (Red Hat package)
ovirt-log-collector (Red Hat package)
ovirt-dependencies (Red Hat package)
postgresql-jdbc (Red Hat package)
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Service Communication Proxy
Planning Analytics Local
Operational Decision Manager
IBM Cloud Pak System
Oracle Financial Services Revenue Management and Billing
Oracle WebCenter Portal
Siebel CRM Deployment
IBM Cloud Pak for Watson AIOps
DataStage on Cloud Pak for Data
RecoverPoint Classic
Oracle Business Intelligence Enterprise Edition
Oracle FLEXCUBE Universal Banking
Oracle Banking Digital Experience
Multi-Enterprise Integration Gateway
B2B Advanced Communications
IBM Watson Compare and Comply for IBM Cloud Pak for Data
Storage Virtualize
Red Hat Virtualization Manager
Oracle Utilities Testing Accelerator
Oracle Financial Services Crime and Compliance Management Studio
Oracle Insurance Policy Administration
Oracle Business Process Management Suite
Confluence Server
IBM i
SUSE Linux Enterprise Module for Development Tools
openEuler
IBM Qradar SIEM
IBM Cognos Command Center
IBM Cognos Controller
Oracle Communications Instant Messaging Server
Oracle Communications Billing and Revenue Management
Oracle Commerce Guided Search
Oracle Banking Payments
IBM InfoSphere Information Server
Oracle JDeveloper
Oracle WebLogic Server
IBM WebSphere Application Server Liberty
Primavera Gateway
Primavera Unifier
watsonx.data
Liberty for Java for IBM Cloud

How to mitigate CVE-2021-36090

Install updates from vendor's website.

Apache Commons Compress - update to 1.21
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.14-1.el8ev
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.4-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.9.0-1.el8ev
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 2.2.1-patch-5, 4.0.2, 4.0.3
Planning Analytics Local - update to 2.0.9.11
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fixpack 4
IBM Cloud Pak for Watson AIOps - update to 3.5.1
ovirt-engine-dwh (Red Hat package) - update to 4.5.3-1.el8ev
ovirt-engine (Red Hat package) - update to 4.5.1.2-0.11.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.5.0-1.el8ev
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
DataStage on Cloud Pak for Data - update to 4.8.5
RecoverPoint Classic - update to 5.1 SP4 P4
IBM Sterling B2B Integrator - update to 6.1.1.2
Confluence Server - addressed in versions 7.19.25, 8.5.12
Confluence Data Center - addressed in versions 7.19.25, 8.5.12, 8.9.4
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.24
IBM Monitor Component - addressed in versions 8.6.3, 8.7.1
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF15
IBM InfoSphere Information Server - addressed in versions 11.7.1.0, 11.7.1.3
Oracle FLEXCUBE Universal Banking - update to 14.3.0
IBM WebSphere Application Server Liberty - update to 21.0.0.10
Primavera Gateway - addressed in versions 18.8.13, 19.12.12, 20.12.8
Oracle Blockchain Platform - update to 21.1.3
Siebel CRM Deployment - update to 22.4
Multi-Enterprise Integration Gateway - update to 1.0.0.8
B2B Advanced Communications - update to 1.0.0.8
IBM Watson Compare and Comply for IBM Cloud Pak for Data - update to 1.1.13
Netcool Operations Insight - update to 1.6.8
IBM Process Mining - update to 1.14.0.0
apache-commons-compress - update to 1.21-1
apache-commons-compress-help - update to 1.21-1
apache-commons-compress (Red Hat package) - update to 1.21-1.2.el8ev
watsonx.data - update to 2.0.2
Liberty for Java for IBM Cloud - update to 3.62-20210922-1852
ovirt-log-collector (Red Hat package) - update to 4.4.6-1.el8ev
ovirt-dependencies (Red Hat package) - update to 4.5.2-1.el8ev
IBM Spectrum Control - update to 5.4.4
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 32, 8.11.1 Interim fix 25, 8.12.0.1 Interim fix 10
IBM Security Verify Governance - update to 10.0.1.0.2
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2
postgresql-jdbc (Red Hat package) - update to 42.2.14-1.el8ev

External References

Related Security Bulletins