Denial of Service Vulnerability in libcommons-compress-java: Memory Allocation Issue
Summary
DEBIAN-CVE-2021-35517: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Affects libcommons-compress-java versions < 1.21-1. Fixed in 1.21-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for reading and writing various compression formats, including TAR, ZIP, and others. It is widely used in applications that require file compression and decompression functionalities. However, a vulnerability has been identified that allows specially crafted TAR archives to exploit the library's memory allocation, leading to potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2021-35517, arises when libcommons-compress-java processes a specially crafted TAR archive. The library can be manipulated to allocate excessive amounts of memory, ultimately resulting in an out-of-memory error, even when handling relatively small inputs. This behavior can be exploited by attackers to launch denial of service attacks against services that utilize the Compress library's TAR package, potentially causing service interruptions and degraded performance.
How To Fix
Minimum fixed version
1.21-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid processing untrusted TAR archives or implement input validation to filter out potentially malicious files before they are processed by the library.
Conclusion
The vulnerability in libcommons-compress-java poses a significant risk of denial of service attacks through memory allocation issues when handling malicious TAR archives. It is crucial to update to the patched version to mitigate this risk and ensure the stability of applications relying on this library.
See every vulnerability recorded for libcommons-compress-java →
FAQ
The vulnerability allows attackers to exploit memory allocation issues in the libcommons-compress-java library when processing specially crafted TAR archives.
The primary impact is a denial of service (DoS) attack, where the affected service may become unresponsive due to excessive memory consumption.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Yes, a patched version of libcommons-compress-java (1.21-1) is available. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, consider implementing input validation or avoiding the processing of untrusted TAR archives as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
