CVE-2021-35517

Q: What is the severity of CVE-2021-35517?

CVE-2021-35517 has a CVSS score of 7.5 (HIGH). CVE-2021-35517 is a denial-of-service vulnerability in Apache Commons Compress where specially crafted TAR archives can trigger excessive memory allocation, leading to out-of-memory errors. This affects any service or application that uses the vulnerable Compress library to process TAR files, potentially causing service disruption.

7.5 HIGH

Denial of Service

📋 TL;DR

CVE-2021-35517 is a denial-of-service vulnerability in Apache Commons Compress where specially crafted TAR archives can trigger excessive memory allocation, leading to out-of-memory errors. This affects any service or application that uses the vulnerable Compress library to process TAR files, potentially causing service disruption.

💻 Affected Systems

Products:

Apache Commons Compress

Versions: Versions 1.19 through 1.21

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Any Java application using the vulnerable Apache Commons Compress library to process TAR archives is affected, regardless of the underlying OS.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service outage due to memory exhaustion, potentially affecting multiple services on the same host if memory is fully consumed.

🟠

Likely Case

Targeted service becomes unresponsive or crashes when processing malicious TAR archives, requiring manual intervention to restore service.

🟢

If Mitigated

Limited impact with proper memory limits and monitoring; service may degrade but not fully crash.

🌐 Internet-Facing: HIGH - Services accepting TAR file uploads from untrusted sources are directly vulnerable to DoS attacks.

🏢 Internal Only: MEDIUM - Internal services processing TAR files from potentially untrusted internal sources could be affected.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only the ability to submit a specially crafted TAR file to a vulnerable service. Public proof-of-concept code exists demonstrating the memory exhaustion attack.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apache Commons Compress 1.22

Vendor Advisory: https://commons.apache.org/proper/commons-compress/security-reports.html

Restart Required: Yes

Instructions:

1. Identify all applications using Apache Commons Compress. 2. Update the commons-compress dependency to version 1.22 or later. 3. Rebuild and redeploy affected applications. 4. Restart services using the updated library.

🔧 Temporary Workarounds

Implement memory limits

all

Set JVM memory limits and implement monitoring to detect and restart services experiencing memory exhaustion.

java -Xmx512m -Xms256m -jar your-application.jar

Input validation and filtering

all

Implement file type validation and size limits for TAR file uploads before passing to Compress library.

🧯 If You Can't Patch

Implement strict file upload controls and only accept TAR files from trusted sources
Deploy memory monitoring and automated restart mechanisms for services processing TAR files

🔍 How to Verify

Check if Vulnerable:

Check the commons-compress version in your application's dependencies. If using Maven: mvn dependency:tree | grep commons-compress. If using Gradle: gradle dependencies | grep commons-compress.

Check Version:

java -cp commons-compress.jar org.apache.commons.compress.utils.IOUtils (check manifest) or check pom.xml/build.gradle for version

Verify Fix Applied:

Verify the commons-compress version is 1.22 or higher in your application's dependencies after update.

📡 Detection & Monitoring

Log Indicators:

OutOfMemoryError exceptions in application logs
JVM heap dump generation
Service restart events following memory exhaustion

Network Indicators:

Unusually large TAR file uploads to services
Repeated TAR file uploads from single sources

SIEM Query:

source="application.logs" AND ("OutOfMemoryError" OR "java.lang.OutOfMemoryError") AND "commons.compress"

📊 Metadata

CVE ID: CVE-2021-35517

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-130

Published: July 13, 2021

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Banking Apis by Oracle

Banking Apis by Oracle

Banking Apis by Oracle

Banking Apis by Oracle

Banking Apis by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Enterprise Default Management by Oracle

Banking Party Management by Oracle

Banking Payments by Oracle

Banking Trade Finance by Oracle

Banking Treasury Management by Oracle

Business Process Management Suite by Oracle

Business Process Management Suite by Oracle

Commerce Guided Search by Oracle

Commons Compress by Apache

Communications Billing And Revenue Management by Oracle

Communications Cloud Native Core Service Communication Proxy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Diameter Intelligence Hub by Oracle

Communications Messaging Server by Oracle

Communications Session Route Manager by Oracle

Financial Services Crime And Compliance Management Studio by Oracle

Financial Services Crime And Compliance Management Studio by Oracle

Financial Services Enterprise Case Management by Oracle

Financial Services Enterprise Case Management by Oracle

Flexcube Universal Banking by Oracle

Flexcube Universal Banking by Oracle

Flexcube Universal Banking by Oracle

Healthcare Data Repository by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Oncommand Insight by Netapp

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Utilities Testing Accelerator by Oracle

Utilities Testing Accelerator by Oracle

Utilities Testing Accelerator by Oracle

Webcenter Portal by Oracle

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Implement memory limits

Input validation and filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export