CVE-2021-35515

Published: Jul 13, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Affected (47)

Products: Apache: Commons Compress · Netapp: Active Iq Unified Manager, Oncommand Insight · Oracle: Banking Digital Experience, Banking Enterprise Default Management, Banking Party Management, Banking Payments, Banking Trade Finance, Banking Treasury Management, Business Process Management Suite, Commerce Guided Search, Communications Billing And Revenue Management, Communications Cloud Native Core Automated Test Suite, Communications Cloud Native Core Service Communication Proxy, Communications Cloud Native Core Unified Data Repository, Communications Diameter Intelligence Hub, Communications Messaging Server, Communications Session Route Manager, Financial Services Crime And Compliance Management Studio, Financial Services Enterprise Case Management, Flexcube Universal Banking, Healthcare Data Repository, Insurance Policy Administration, Peoplesoft Enterprise Peopletools, Primavera Unifier, Utilities Testing Accelerator

1 product

Commons Compress

2 products

Active Iq Unified Manager

Oncommand Insight

23 products

Banking Digital Experience

Banking Enterprise Default Management

Banking Party Management

Banking Payments

Banking Trade Finance

Banking Treasury Management

Business Process Management Suite

Commerce Guided Search

Communications Billing And Revenue Management

Communications Cloud Native Core Automated Test Suite

Communications Cloud Native Core Service Communication Proxy

Communications Cloud Native Core Unified Data Repository

Communications Diameter Intelligence Hub

Communications Messaging Server

Communications Session Route Manager

Financial Services Crime And Compliance Management Studio

Financial Services Enterprise Case Management

Flexcube Universal Banking

Healthcare Data Repository

Insurance Policy Administration

Peoplesoft Enterprise Peopletools

Primavera Unifier

Utilities Testing Accelerator

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Commons Compress	From 1.6 to 1.20

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Oncommand Insight	All versions

Configuration C

42 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Digital Experience	From 18.1 to 18.3
Oracle Banking Digital Experience	Version 19.1
Oracle Banking Digital Experience	Version 20.1
Oracle Banking Digital Experience	Version 21.1
Oracle Banking Enterprise Default Management	Version 2.7.0
Oracle Banking Party Management	Version 2.7.0
Oracle Banking Payments	Version 14.5
Oracle Banking Trade Finance	Version 14.5
Oracle Banking Treasury Management	Version 14.5
Oracle Business Process Management Suite	Version 12.2.1.3.0
Oracle Business Process Management Suite	Version 12.2.1.4.0
Oracle Commerce Guided Search	Version 11.3.2
Oracle Communications Billing And Revenue Management	Version 12.0.0.4
Oracle Communications Cloud Native Core Automated Test Suite	Version 1.8.0
Oracle Communications Cloud Native Core Service Communication Proxy	Version 1.14.0
Oracle Communications Cloud Native Core Unified Data Repository	Version 1.14.0
Oracle Communications Diameter Intelligence Hub	From 8.0.0 to 8.2.3
Oracle Communications Messaging Server	Version 8.1
Oracle Communications Session Route Manager	From 8.0.0 to 8.2.5
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.2.0
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.3.0
Oracle Financial Services Enterprise Case Management	Version 8.0.7.2.0
Oracle Financial Services Enterprise Case Management	Version 8.0.8.1.0
Oracle Flexcube Universal Banking	From 14.0.0 to 14.3.0
Oracle Flexcube Universal Banking	Version 12.4.0
Oracle Flexcube Universal Banking	Version 14.5.0
Oracle Healthcare Data Repository	Version 8.1.0
Oracle Insurance Policy Administration	Version 11.0.2
Oracle Insurance Policy Administration	Version 11.1.0
Oracle Insurance Policy Administration	Version 11.2.8
Oracle Insurance Policy Administration	Version 11.3.0
Oracle Insurance Policy Administration	Version 11.3.1
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Primavera Unifier	Version 20.12
Oracle Utilities Testing Accelerator	Version 6.0.0.1.1
Oracle Utilities Testing Accelerator	Version 6.0.0.2.2
Oracle Utilities Testing Accelerator	Version 6.0.0.3.1

Related CWEs

Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (42)

http://www.openwall.com/lists/oss-security/2021/07/13/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://commons.apache.org/proper/commons-compress/security-reports.html

Source: security@apache.org

Vendor Advisory

https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E

Source: security@apache.org

Vendor Advisory

https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E

Source: security@apache.org

https://security.netapp.com/advisory/ntap-20211022-0001/

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/07/13/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://commons.apache.org/proper/commons-compress/security-reports.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69%40%3Cannounce.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20211022-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.