Bugzilla – Bug 1188463
VUL-0: CVE-2021-35515: apache-commons-compress: infinite loop when reading a specially crafted 7Z archive
Last modified: 2024-05-24 10:40:44 UTC
rh#1981895 When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package. References: https://commons.apache.org/proper/commons-compress/security-reports.html https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E http://www.openwall.com/lists/oss-security/2021/07/13/1 References: https://bugzilla.redhat.com/show_bug.cgi?id=1981895 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-35515 http://seclists.org/oss-sec/2021/q3/9 http://www.openwall.com/lists/oss-security/2021/07/13/1 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35515 https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E https://commons.apache.org/proper/commons-compress/security-reports.html
openSUSE-SU-2021:2612-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1188463,1188464,1188465,1188466 CVE References: CVE-2021-35515,CVE-2021-35516,CVE-2021-35517,CVE-2021-36090 JIRA References: Sources used: openSUSE Leap 15.3 (src): apache-commons-compress-1.21-3.3.1
SUSE-SU-2021:2612-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1188463,1188464,1188465,1188466 CVE References: CVE-2021-35515,CVE-2021-35516,CVE-2021-35517,CVE-2021-36090 JIRA References: Sources used: SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): apache-commons-compress-1.21-3.3.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): apache-commons-compress-1.21-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:1115-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1188463,1188464,1188465,1188466 CVE References: CVE-2021-35515,CVE-2021-35516,CVE-2021-35517,CVE-2021-36090 JIRA References: Sources used: openSUSE Leap 15.2 (src): apache-commons-compress-1.21-lp152.2.3.1
All done, closing.