CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' TAR package. The highest threat from this vulnerability is to system availability.
Other sources
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/apache-commons-compressto a version that resolves this vulnerability.Fixed in 0:1.21-1.2.el8e - Upgrade
Upgrade
redhat/apache-commons-compressto a version that resolves this vulnerability.Fixed in 1.21
Event History
Parent advisories
This vulnerability appears in the following advisories.