Resource exhaustion in Apache Commons Compress - CVE-2021-35517

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54852

Resource exhaustion in Apache Commons Compress - CVE-2021-35517

Published: July 14, 2021 / Updated: July 29, 2024


Vulnerability identifier: #VU54852
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-35517
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing TAR archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Apache Commons Compress
IBM Observability with Instana
NovaLink
IBM Watson Discovery for IBM Cloud Pak for Data
IBM IoT MessageSight
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Transformation Advisor
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM WIoTP MessageGateway
IBM Sterling B2B Integrator
IBM Sterling Control Center
Confluence Data Center
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Monitor Component
Netcool Operations Insight
IBM Process Mining
IBM Spectrum Control
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-ui-extensions (Red Hat package)
ovirt-web-ui (Red Hat package)
ovirt-engine-dwh (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
apache-commons-compress-help
apache-commons-compress
apache-commons-compress (Red Hat package)
ovirt-log-collector (Red Hat package)
ovirt-dependencies (Red Hat package)
postgresql-jdbc (Red Hat package)
Planning Analytics Local
Operational Decision Manager
Red Hat Virtualization Manager
DataStage on Cloud Pak for Data
Multi-Enterprise Integration Gateway
B2B Advanced Communications
IBM Watson Compare and Comply for IBM Cloud Pak for Data
Storage Virtualize
Confluence Server
IBM i
SUSE Linux Enterprise Module for Development Tools
openEuler
IBM Qradar SIEM
IBM Cognos Command Center
IBM Cognos Controller
IBM InfoSphere Information Server
IBM WebSphere Application Server Liberty
watsonx.data
Liberty for Java for IBM Cloud

How to mitigate CVE-2021-35517

Install updates from vendor's website.

Apache Commons Compress - update to 1.21
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.14-1.el8ev
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.4-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.9.0-1.el8ev
Planning Analytics Local - update to 2.0.9.11
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 2.2.1-patch-5, 4.0.2, 4.0.3
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fixpack 4
ovirt-engine-dwh (Red Hat package) - update to 4.5.3-1.el8ev
ovirt-engine (Red Hat package) - update to 4.5.1.2-0.11.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.5.0-1.el8ev
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
DataStage on Cloud Pak for Data - update to 4.8.5
IBM Sterling B2B Integrator - update to 6.1.1.2
Confluence Data Center - addressed in versions 7.19.25, 8.5.12, 8.9.4
Confluence Server - addressed in versions 7.19.25, 8.5.12
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.24
IBM Monitor Component - addressed in versions 8.6.3, 8.7.1
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF15
IBM InfoSphere Information Server - addressed in versions 11.7.1.0, 11.7.1.3
IBM WebSphere Application Server Liberty - update to 21.0.0.10
Multi-Enterprise Integration Gateway - update to 1.0.0.8
B2B Advanced Communications - update to 1.0.0.8
IBM Watson Compare and Comply for IBM Cloud Pak for Data - update to 1.1.13
Netcool Operations Insight - update to 1.6.10
IBM Process Mining - update to 1.14.0.0
apache-commons-compress-help - update to 1.21-1
apache-commons-compress - update to 1.21-1
apache-commons-compress (Red Hat package) - update to 1.21-1.2.el8ev
watsonx.data - update to 2.0.2
Liberty for Java for IBM Cloud - update to 3.62-20210922-1852
ovirt-log-collector (Red Hat package) - update to 4.4.6-1.el8ev
ovirt-dependencies (Red Hat package) - update to 4.5.2-1.el8ev
IBM Spectrum Control - update to 5.4.4
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 32, 8.11.1 Interim fix 25, 8.12.0.1 Interim fix 10
IBM Security Verify Governance - update to 10.0.1.0.2
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2
postgresql-jdbc (Red Hat package) - update to 42.2.14-1.el8ev

External References

Related Security Bulletins