Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1jODQtcGo5OS1xNmho

Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Permalink: https://github.com/advisories/GHSA-mc84-pj99-q6hh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1jODQtcGo5OS1xNmho
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-mc84-pj99-q6hh, CVE-2021-36090
References: Blast Radius: 32.8

Affected Packages

maven:org.apache.commons:commons-compress
Dependent packages: 2,934
Dependent repositories: 23,921
Downloads:
Affected Version Ranges: < 1.21
Fixed in: 1.21
All affected versions: 1.4.1, 1.8.1, 1.16.1
All unaffected versions: 1.23.0, 1.24.0, 1.25.0, 1.26.0, 1.26.1