SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-35515

This could be used to mount a denial of service attack against services that use Compress' sevenz package.

HIGH 7.5EPSS 11.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 11.6%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

CVSS 3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
11.57% probability · 96th percentile
CISA KEV
Not listed
Weakness
CWE-834, CWE-835
Affected
apache/commons compress · netapp/active iq unified manager · netapp/oncommand insight · oracle/banking digital experience · oracle/banking enterprise default management · oracle/banking party management · oracle/banking payments · oracle/banking trade finance · oracle/banking treasury management · oracle/business process management suite · oracle/commerce guided search · oracle/communications billing and revenue management · oracle/communications cloud native core automated test suite · oracle/communications cloud native core service communication proxy · oracle/communications cloud native core unified data repository · oracle/communications diameter intelligence hub · oracle/communications session route manager · oracle/financial services crime and compliance management studio · oracle/financial services enterprise case management · oracle/flexcube universal banking · +6 more
Source
security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.