Infinite loop in Apache Commons Compress - CVE-2021-35515

Vulnerability identifier: #VU54854

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35515

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing 7Z archives. A remote attacker can consume all available system resources and cause denial of service conditions.

Apache Commons Compress
IBM Observability with Instana
Oracle Communications Cloud Native Core Automated Test Suite
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
Confluence Data Center
IBM Tivoli Netcool/OMNIbus WebGUI
Netcool Operations Insight
IBM Process Mining
IBM Cloud Transformation Advisor
IBM Spectrum Control
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-ui-extensions (Red Hat package)
ovirt-web-ui (Red Hat package)
ovirt-engine-dwh (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
apache-commons-compress
apache-commons-compress-help
apache-commons-compress (Red Hat package)
ovirt-log-collector (Red Hat package)
ovirt-dependencies (Red Hat package)
postgresql-jdbc (Red Hat package)
Red Hat Virtualization Manager
DataStage on Cloud Pak for Data
B2B Advanced Communications
Multi-Enterprise Integration Gateway
IBM Watson Compare and Comply for IBM Cloud Pak for Data
Storage Virtualize
Confluence Server
IBM Qradar SIEM
IBM InfoSphere Information Server
SUSE Linux Enterprise Module for Development Tools
openEuler
watsonx.data
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
Operational Decision Manager

Install updates from vendor's website.

Apache Commons Compress - update to 1.21
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.14-1.el8ev
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.4-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.9.0-1.el8ev
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 4.0.2
ovirt-engine-dwh (Red Hat package) - update to 4.5.3-1.el8ev
ovirt-engine (Red Hat package) - update to 4.5.1.2-0.11.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.5.0-1.el8ev
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
DataStage on Cloud Pak for Data - update to 4.8.5
IBM Sterling B2B Integrator - update to 6.1.1.2
Confluence Data Center - addressed in versions 7.19.25, 8.5.12, 8.9.4
Confluence Server - addressed in versions 7.19.25, 8.5.12
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.24
IBM InfoSphere Information Server - addressed in versions 11.7.1.0, 11.7.1.3
B2B Advanced Communications - update to 1.0.0.8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
IBM Watson Compare and Comply for IBM Cloud Pak for Data - update to 1.1.13
Netcool Operations Insight - update to 1.6.10
IBM Process Mining - update to 1.14.0.0
apache-commons-compress - update to 1.21-1
apache-commons-compress-help - update to 1.21-1
apache-commons-compress (Red Hat package) - update to 1.21-1.2.el8ev
watsonx.data - update to 2.0.2
IBM Cloud Transformation Advisor - update to 3.10.0
ovirt-log-collector (Red Hat package) - update to 4.4.6-1.el8ev
ovirt-dependencies (Red Hat package) - update to 4.5.2-1.el8ev
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
IBM Spectrum Control - update to 5.4.4
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 32, 8.11.1 Interim fix 25, 8.12.0.1 Interim fix 10
IBM Security Verify Governance - update to 10.0.1.0.2
postgresql-jdbc (Red Hat package) - update to 42.2.14-1.el8ev

• https://commons.apache.org/proper/commons-compress/security-reports.html
• https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/07/13/1

• Multiple vulnerabilities in Apache Commons Compress
• SUSE Linux Enterprise Module for Development Tools update for apache-commons-compress
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Denial of service in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Watson Compare and Comply for IBM Cloud Pak for Data
• IBM Sterling B2B Integrator update for Apache Commons Compress
• Multiple vulnerabilities in Apache Commons affect Tivoli Netcool/OMNIbus WebGUI
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM B2B Advanced Communications
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Application Performance Management
• openEuler update for apache-commons-compress
• Multiple vulnerabilities in IBM Storage Virtualize
• Confluence Data Center and Server update for Apache Commons Compress
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Knowledge Catalog