Denial of Service Vulnerability in libcommons-compress-java: Infinite Loop in 7Z Archive Handling
Summary
CVE-2021-35515: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. Affects libcommons-compress-java versions >= c49e865f4eabd47e264063499e27e12eb549feb1, <= f7503adfbad8b44eb079d564f2784aeaa034647c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for reading and writing various compressed file formats, including ZIP, TAR, and 7Z. It is widely used in applications that require file compression and decompression functionalities. The library is essential for developers looking to integrate compression features into their Java applications. However, a vulnerability has been identified that affects its handling of specially crafted 7Z archives, which can lead to significant performance issues.
Vulnerability Detail
The vulnerability, identified as CVE-2021-35515, arises when the libcommons-compress-java library processes a specially crafted 7Z archive. The construction of the list of codecs that decompress an entry can enter an infinite loop, leading to a denial of service (DoS) condition. This vulnerability can be exploited by an attacker who sends a maliciously crafted 7Z file to a service using the library, potentially causing the service to become unresponsive. The severity of this vulnerability is reflected in its CVSS score of 7.5, indicating a high risk to affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to avoid processing untrusted or unknown 7Z archives until the library is updated. Additionally, implementing input validation to check the integrity and source of the 7Z files before processing can help mitigate the risk.
Conclusion
CVE-2021-35515 represents a significant risk to applications using the libcommons-compress-java library, particularly in how they handle 7Z archives. Upgrading to the latest version is crucial to mitigate this vulnerability and ensure the stability and security of your applications.
See every vulnerability recorded for libcommons-compress-java →
FAQ
CVE-2021-35515 is a vulnerability in the libcommons-compress-java library that can lead to a denial of service due to an infinite loop when processing specially crafted 7Z archives.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to service downtime, as the application may become unresponsive when processing malicious 7Z files.
Yes, you can avoid processing untrusted 7Z archives and implement input validation to check the integrity of the files before processing.
The CVSS score for CVE-2021-35515 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
