Denial of Service Vulnerability in libcommons-compress-java: Infinite Loop in 7Z Archive Handling
Summary
DEBIAN-CVE-2021-35515: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. Affects libcommons-compress-java versions < 1.21-1. Fixed in 1.21-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for reading and writing various archive formats, including ZIP, TAR, and 7Z. It is widely used in applications that require file compression and decompression functionalities. The library's handling of 7Z archives is crucial for ensuring that applications can manage compressed files effectively. However, a vulnerability has been identified that could lead to service disruptions when processing specially crafted 7Z files.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2021-35515, arises from the way libcommons-compress-java processes certain 7Z archives. When the library encounters a specially crafted archive, it can enter an infinite loop while constructing the list of codecs necessary for decompressing an entry. This behavior can be exploited to mount a denial of service (DoS) attack, potentially rendering services that rely on this library unresponsive. The issue is significant as it affects the stability and availability of applications using the library, especially in environments where 7Z files are common.
How To Fix
Minimum fixed version
1.21-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or unknown 7Z archives until the package is updated. Additionally, implement input validation to check the integrity of 7Z files before processing them.
Conclusion
The vulnerability in libcommons-compress-java poses a significant risk to applications that handle 7Z archives, potentially leading to denial of service. It is crucial to update to the patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libcommons-compress-java →
FAQ
The vulnerability allows for an infinite loop when processing specially crafted 7Z archives, leading to potential denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Versions prior to 1.21-1 are affected by this vulnerability.
Yes, updating to version 1.21-1 or later will resolve the vulnerability.
If immediate updates are not possible, avoid processing untrusted 7Z files and implement input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
