====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN357
_____________________________________________________________________

DATE                : 15/07/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Commons Compress versions
                            prior to 1.21.

=====================================================================
http://mail-archives.apache.org/mod_mbox/commons-user/202107.mbox/%3c7e8d9fb4-1295-a54c-f27b-588fbdcfacd6@apache.org%3e
http://mail-archives.apache.org/mod_mbox/commons-user/202107.mbox/%3c84d2a23f-1218-6118-c235-a010758c8782@apache.org%3e
http://mail-archives.apache.org/mod_mbox/commons-user/202107.mbox/%3c7898f0a4-413f-398e-2647-4f137a877790@apache.org%3e
http://mail-archives.apache.org/mod_mbox/commons-user/202107.mbox/%3cdf4d3899-4b91-df70-4d02-6583ea48309c@apache.org%3e
_____________________________________________________________________

CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service
vulnerability


Severity: low

Description:

When reading a specially crafted 7Z archive, the construction of the
list of codecs that decompress an entry can result
in an infinite loop.  This could be used to mount a denial of service
attack against services that use Compress' sevenz
package.


Mitigation:

Commons Compress users should upgrade to 1.21 or later.


Credit:

This issue was discovered by OSS Fuzz.


References:

https://commons.apache.org/proper/commons-compress/security-reports.html

_____________________________________________________________________

CVE-2021-35516: Apache Commons Compress 1.6 to 1.20 denial of service
vulnerability

Severity: low

Description:

When reading a specially crafted 7Z archive, Compress can be made to
allocate large amounts of memory that finally
leads to an out of memory error even for very small inputs. This could
be used to mount a denial of service attack
against services that use Compress' sevenz package.


This issue is being tracked as COMPRESS-542


Mitigation:

Commons Compress users should upgrade to 1.21 or later.

With Compress 1.19 we introduced a feature that tries to recover broken
7z archives, which makes it far easier to
exploit this weakness. As a result we have disabled the recovery code by
default and users need to enable it
explicitly. In addition users are able to control the amount of memory
SevenZFile may use and we strongly recommend
using this feature when trying to recover broken archives.


Credit:

This issue was first reported to the project's issue tracker as
COMPRESS-542 by Robin Schimpf. Later OSS Fuzz detected
ways to exploit this issue which managed to escape the initial attempt
to fix it.


References:

https://commons.apache.org/proper/commons-compress/security-reports.html

_____________________________________________________________________

CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service
vulnerability


Description:

When reading a specially crafted TAR archive, Compress can be made to
allocate large amounts of memory that finally
leads to an out of memory error even for very small inputs. This could
be used to mount a denial of service attack
against services that use Compress' tar package.


Mitigation:

Commons Compress users should upgrade to 1.21 or later.


Credit:

This issue was discovered by OSS Fuzz.


References:

https://commons.apache.org/proper/commons-compress/security-reports.html

_____________________________________________________________________

CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service
vulnerability


Description:

When reading a specially crafted TAR archive, Compress can be made to
allocate large amounts of memory that finally
leads to an out of memory error even for very small inputs. This could
be used to mount a denial of service attack
against services that use Compress' tar package.


Mitigation:

Commons Compress users should upgrade to 1.21 or later.


Credit:

This issue was discovered by OSS Fuzz.


References:

https://commons.apache.org/proper/commons-compress/security-reports.html




=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================