Denial of Service Vulnerability in libcommons-compress-java: Memory Allocation Issue
Summary
DEBIAN-CVE-2021-35516: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Affects libcommons-compress-java versions < 1.21-1. Fixed in 1.21-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for reading and writing various compressed file formats, including 7Z archives. It is widely used in applications that require file compression and decompression functionalities. The library is designed to handle different compression algorithms efficiently, making it a popular choice among developers. However, a vulnerability has been identified that allows for excessive memory allocation when processing specially crafted 7Z archives, potentially leading to denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability arises when the libcommons-compress-java library processes a specially crafted 7Z archive. This can cause the library to allocate large amounts of memory, ultimately resulting in an out of memory error, even with very small input files. This behavior can be exploited by attackers to mount denial of service attacks against services that utilize the Compress library's sevenz package, disrupting normal operations and affecting availability.
How To Fix
Minimum fixed version
1.21-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that only trusted and properly formatted 7Z archives are processed. This can help mitigate the risk of processing malicious files that exploit the vulnerability.
Conclusion
The libcommons-compress-java library has a vulnerability that can lead to denial of service through excessive memory allocation when handling specially crafted 7Z archives. It is crucial to update to the patched version 1.21-1 to mitigate this risk. In the meantime, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for libcommons-compress-java →
FAQ
The vulnerability allows for excessive memory allocation when processing specially crafted 7Z archives, leading to potential denial of service attacks.
You can use the Vulert platform to check if your application is affected by this vulnerability by analyzing your manifest file like package-lock.json.
The main consequence is a denial of service, where the application may become unresponsive or crash due to excessive memory usage.
Yes, the patched version of libcommons-compress-java is 1.21-1. It is recommended to update to this version.
If immediate updates are not possible, implement input validation to restrict the processing of untrusted 7Z archives as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
