PT-2021-3850 · Apache+4 · Apache Commons Compress+4

Oss Fuzz · Published 2021-07-13 · Updated 2024-08-06 · CVE-2021-35517

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Confluence Data Center versions 7.19.23 through 8.9.3 Confluence Server versions 7.19.23 through 8.5.11 Apache Commons Compress (affected versions not specified)

Description The issue is related to the allocation of unlimited memory when reading a specially crafted TAR archive, which can lead to an out of memory error. This could be used to mount a denial of service attack against services that use Compress' tar package.

Recommendations For Confluence Data Center versions from 8.9.2 to 8.9.3, upgrade to version 8.9.4. For Confluence Data Center versions from 8.5.10 to 8.5.11 LTS, upgrade to version 8.9.4 or 8.5.12 LTS. For Confluence Data Center versions from 7.19.23 to 7.19.24 LTS, upgrade to version 8.9.4 or 8.5.12 LTS or 7.19.25 LTS. For Confluence Server versions from 8.5.10 to 8.5.11 LTS, upgrade to version 8.5.12 LTS. For Confluence Server versions from 7.19.23 to 7.19.24 LTS, upgrade to version 8.5.12 LTS or 7.19.25 LTS. As a temporary workaround, consider restricting the use of the Compress tar package until a patch is available.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-130

Related Identifiers

AZL-44490

BDU:2021-04206

CVE-2021-35517

GHSA-XQFJ-VM6H-2X34

MGASA-2022-0009

OESA-2021-1302

OPENSUSE-SU-2021:1115-1

OPENSUSE-SU-2021:2612-1

OPENSUSE-SU-2021_1115-1

OPENSUSE-SU-2021_2612-1

OPENSUSE-SU-2024:10618-1

RHSA-2022:5555

SUSE-SU-2021:2612-1

Affected Products

Apache Commons Compress

Confluence

Debian

Red Os

Suse

References · 86

• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36090 · Security Note
• https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2612-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35517 · Security Note
• https://bdu.fstec.ru/vul/2021-04206 · Security Note
• https://commons.apache.org/proper/commons-compress/security-reports.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35517 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-35517 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/MGASA-2022-0009 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xqfj-vm6h-2x34 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35517 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1302 · Vendor Advisory