2021-07-01 08:01:01 +00:00
{
"CVE_data_meta" : {
2021-07-13 08:13:08 +01:00
"ASSIGNER" : "security@apache.org" ,
2021-07-01 08:01:01 +00:00
"ID" : "CVE-2021-36090" ,
2021-07-13 08:13:08 +01:00
"STATE" : "PUBLIC" ,
"TITLE" : "Apache Commons Compress 1.0 to 1.20 denial of service vulnerability"
2021-07-01 08:01:01 +00:00
} ,
2021-07-13 08:13:08 +01:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "Apache Commons Compress" ,
"version" : {
"version_data" : [
{
"version_affected" : "<=" ,
"version_name" : "Apache Commons Compress" ,
"version_value" : "1.20"
}
]
}
}
]
} ,
"vendor_name" : "Apache Software Foundation"
}
]
}
} ,
"credit" : [
{
"lang" : "eng" ,
"value" : "This issue was discovered by OSS Fuzz."
}
] ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2021-07-01 08:01:01 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-07-13 08:00:59 +00:00
"value" : "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package."
2021-07-01 08:01:01 +00:00
}
]
2021-07-13 08:13:08 +01:00
} ,
"generator" : {
"engine" : "Vulnogram 0.0.9"
} ,
"impact" : [
{ }
] ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-130 Improper Handling of Length Parameter Inconsistency "
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
2021-07-13 08:00:59 +00:00
"refsource" : "MISC" ,
"url" : "https://commons.apache.org/proper/commons-compress/security-reports.html" ,
"name" : "https://commons.apache.org/proper/commons-compress/security-reports.html"
2021-07-13 08:13:08 +01:00
} ,
{
2021-07-13 08:00:59 +00:00
"refsource" : "MISC" ,
"url" : "https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E" ,
"name" : "https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E"
2021-07-13 09:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[oss-security] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability" ,
"url" : "http://www.openwall.com/lists/oss-security/2021/07/13/4"
2021-07-13 17:00:55 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[announce] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability" ,
"url" : "https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53@%3Cannounce.apache.org%3E"
2021-07-13 19:00:48 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ant-user] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability" ,
"url" : "https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38@%3Cuser.ant.apache.org%3E"
2021-07-13 20:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[announce] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability" ,
"url" : "https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E"
2021-07-13 21:00:56 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[oss-security] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability" ,
"url" : "http://www.openwall.com/lists/oss-security/2021/07/13/6"
2021-07-14 09:00:48 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[james-notifications] 20210714 [GitHub] [james-project] chibenwa opened a new pull request #537: [UPGRADE] Security upgrade: common-compress to 1.21" ,
"url" : "https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7@%3Cnotifications.james.apache.org%3E"
2021-07-16 21:00:58 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21" ,
"url" : "https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E"
2021-07-26 15:00:50 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E"
2021-07-27 00:00:53 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496)" ,
"url" : "https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E"
2021-08-03 05:00:51 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E"
2021-08-03 06:00:54 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400)" ,
"url" : "https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E"
2021-08-04 05:00:51 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-dev] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf@%3Cdev.drill.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-issues] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6@%3Cissues.drill.apache.org%3E"
2021-08-04 07:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-dev] 20210804 [GitHub] [drill] luocooong opened a new pull request #2285: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d@%3Cdev.drill.apache.org%3E"
2021-08-04 14:00:55 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-commits] 20210804 [drill] branch master updated: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949@%3Ccommits.drill.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-dev] 20210804 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab@%3Cdev.drill.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-issues] 20210804 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a@%3Cissues.drill.apache.org%3E"
2021-08-05 14:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-dev] 20210805 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456@%3Cdev.drill.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-issues] 20210805 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090" ,
"url" : "https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd@%3Cissues.drill.apache.org%3E"
2021-08-11 19:00:55 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[tomcat-dev] 20210811 [GitHub] [tomcat-jakartaee-migration] ebourg commented on issue #23: Vulnerability with Apache Commons Compress v1.20" ,
"url" : "https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5@%3Cdev.tomcat.apache.org%3E"
2021-09-23 13:00:56 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1)" ,
"url" : "https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E"
2021-10-19 14:23:14 -07:00
} ,
{
2021-10-20 11:02:08 +00:00
"url" : "https://www.oracle.com/security-alerts/cpuoct2021.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/security-alerts/cpuoct2021.html"
2021-10-22 18:00:55 +00:00
} ,
2022-02-07 16:01:25 +00:00
{
"url" : "https://www.oracle.com/security-alerts/cpujan2022.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/security-alerts/cpujan2022.html"
} ,
2021-10-22 18:00:55 +00:00
{
"refsource" : "CONFIRM" ,
"name" : "https://security.netapp.com/advisory/ntap-20211022-0001/" ,
"url" : "https://security.netapp.com/advisory/ntap-20211022-0001/"
2022-04-19 16:28:20 -07:00
} ,
{
2022-04-20 00:03:03 +00:00
"url" : "https://www.oracle.com/security-alerts/cpuapr2022.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/security-alerts/cpuapr2022.html"
2022-07-19 14:38:32 -07:00
} ,
{
2022-07-25 19:01:27 +00:00
"url" : "https://www.oracle.com/security-alerts/cpujul2022.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/security-alerts/cpujul2022.html"
2021-07-13 08:13:08 +01:00
}
]
} ,
"source" : {
"discovery" : "UNKNOWN"
} ,
"work_around" : [
{
"lang" : "eng" ,
"value" : "Commons Compress users should upgrade to 1.21 or later."
}
]
2021-07-13 08:00:59 +00:00
}
