CVE-2021-35515

Q: What is the severity of CVE-2021-35515?

CVE-2021-35515 has a CVSS score of 7.5 (HIGH). CVE-2021-35515 is a denial-of-service vulnerability in Apache Commons Compress's 7Z archive handling. When processing a specially crafted 7Z file, the codec list construction can enter an infinite loop, causing resource exhaustion. This affects any service or application that uses the vulnerable commons-compress library to process 7Z archives.

7.5 HIGH

Denial of Service

📋 TL;DR

CVE-2021-35515 is a denial-of-service vulnerability in Apache Commons Compress's 7Z archive handling. When processing a specially crafted 7Z file, the codec list construction can enter an infinite loop, causing resource exhaustion. This affects any service or application that uses the vulnerable commons-compress library to process 7Z archives.

💻 Affected Systems

Products:

Apache Commons Compress

Versions: Versions 1.15 through 1.20

Operating Systems: All operating systems

Default Config Vulnerable: ⚠️ Yes

Notes: Any application or service using the vulnerable commons-compress library to process 7Z archives is affected, regardless of configuration.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to resource exhaustion (CPU/memory) when processing malicious 7Z archives, potentially affecting multiple services simultaneously.

🟠

Likely Case

Service degradation or temporary unavailability for systems that process user-uploaded 7Z files, requiring manual intervention to restart affected services.

🟢

If Mitigated

Minimal impact with proper input validation, rate limiting, and monitoring in place to detect and block malicious archives before processing.

🌐 Internet-Facing: HIGH - Any internet-facing service accepting 7Z file uploads or processing 7Z archives from untrusted sources is vulnerable to DoS attacks.

🏢 Internal Only: MEDIUM - Internal systems processing 7Z archives from potentially untrusted sources could be affected, but attack surface is more limited.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only the ability to submit a specially crafted 7Z file to a vulnerable service. Proof-of-concept details are publicly available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apache Commons Compress 1.21

Vendor Advisory: https://commons.apache.org/proper/commons-compress/security-reports.html

Restart Required: Yes

Instructions:

1. Identify all applications using Apache Commons Compress. 2. Update commons-compress dependency to version 1.21 or later. 3. Rebuild and redeploy affected applications. 4. Restart services using the updated library.

🔧 Temporary Workarounds

Input validation and filtering

all

Implement strict validation of 7Z files before processing, including file size limits and format validation.

Process isolation

linux

Run 7Z archive processing in isolated containers or processes with resource limits to prevent system-wide impact.

docker run --memory=512m --cpus=1.0 your_app

🧯 If You Can't Patch

Implement strict rate limiting on 7Z file uploads/processing to limit attack impact
Deploy WAF rules to detect and block malicious 7Z archives before they reach vulnerable systems

🔍 How to Verify

Check if Vulnerable:

Check your application's dependencies for Apache Commons Compress versions 1.15 through 1.20. For Maven projects: mvn dependency:tree | grep commons-compress. For Gradle: gradle dependencies | grep commons-compress.

Check Version:

java -cp commons-compress.jar org.apache.commons.compress.utils.IOUtils 2>&1 | grep version || echo "Check pom.xml or build.gradle for version"

Verify Fix Applied:

Verify commons-compress version is 1.21 or later. Test with known safe 7Z archives to ensure processing works correctly without resource exhaustion.

📡 Detection & Monitoring

Log Indicators:

Unusually long processing times for 7Z files
High CPU/memory usage spikes during archive processing
Service restarts or crashes when handling archives

Network Indicators:

Multiple 7Z file uploads from single source in short time
Unusual archive file sizes or patterns

SIEM Query:

source="application.logs" AND ("7z" OR "sevenz") AND ("timeout" OR "hang" OR "high cpu" OR "out of memory")

📊 Metadata

CVE ID: CVE-2021-35515

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-834

Published: July 13, 2021

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Enterprise Default Management by Oracle

Banking Party Management by Oracle

Banking Payments by Oracle

Banking Trade Finance by Oracle

Banking Treasury Management by Oracle

Business Process Management Suite by Oracle

Business Process Management Suite by Oracle

Commerce Guided Search by Oracle

Commons Compress by Apache

Communications Billing And Revenue Management by Oracle

Communications Cloud Native Core Automated Test Suite by Oracle

Communications Cloud Native Core Service Communication Proxy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Diameter Intelligence Hub by Oracle

Communications Messaging Server by Oracle

Communications Session Route Manager by Oracle

Financial Services Crime And Compliance Management Studio by Oracle

Financial Services Crime And Compliance Management Studio by Oracle

Financial Services Enterprise Case Management by Oracle

Financial Services Enterprise Case Management by Oracle

Flexcube Universal Banking by Oracle

Flexcube Universal Banking by Oracle

Flexcube Universal Banking by Oracle

Healthcare Data Repository by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Oncommand Insight by Netapp

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Utilities Testing Accelerator by Oracle

Utilities Testing Accelerator by Oracle

Utilities Testing Accelerator by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Input validation and filtering

Process isolation

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities