GitHub Advisoryadvisory · Maven

GHSA-7hfm-57qf-j43q Excessive Iteration in Compress

HIGH Published 2021-08-02 Modified 2022-02-08 Official page ↗
Aliases
CVE-2021-35515
Ecosystem
Maven
Packages
org.apache.commons:commons-compress
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-834, CWE-835
Reviewed
2021-07-14

Affected packages

• Maven org.apache.commons:commons-compress: < 1.21 → fixed in 1.21

Description

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Related

Alias · CVE (1)

  • CVE-2021-35515 When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. vulnerability

Weakness · CWE (2)

  • CWE-834 Excessive Iteration weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References