Strix
26.1K

CVE-2021-36090

HIGHCVSS 7.5/10EPSS 13.29%

Last modified

CVE-2021-36090 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.. EPSS estimates a 13.29% chance of exploitation in the next 30 days.

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
13.29%

95.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheCommons Compress>= 1.0, < 1.21
OracleBanking Apis>= 18.1, <= 18.3
OracleBanking Apis19.1
OracleBanking Apis19.2
OracleBanking Apis20.1
OracleBanking Apis21.1
OracleBanking Digital Experience>= 18.1, <= 18.3
OracleBanking Digital Experience19.1
OracleBanking Digital Experience19.2
OracleBanking Digital Experience20.1
OracleBanking Digital Experience21.1
OracleBanking Enterprise Default Management2.7.0
OracleBanking Party Management2.7.0
OracleBanking Payments14.5
OracleBanking Platform2.6.2
OracleBanking Platform2.7.1
OracleBanking Platform2.9.0
OracleBanking Platform2.12.0
OracleBanking Trade Finance14.5
OracleBanking Treasury Management14.5
OracleBusiness Process Management Suite12.2.1.3.0
OracleBusiness Process Management Suite12.2.1.4.0
OracleCommerce Guided Search11.3.2
OracleCommunications Billing And Revenue Management12.0.0.4
OracleCommunications Cloud Native Core Automated Test Suite1.8.0
OracleCommunications Cloud Native Core Service Communication Proxy1.14.0
OracleCommunications Cloud Native Core Unified Data Repository1.14.0
OracleCommunications Diameter Intelligence Hub>= 8.0.0, <= 8.2.3
OracleCommunications Diameter Intelligence Hub8.2.3
OracleCommunications Element Manager>= 8.2.0, <= 8.2.4.0
OracleCommunications Session Report Manager>= 8.2.0, <= 8.2.5.0
OracleCommunications Session Route Manager>= 8.0.0, <= 8.2.5.0
OracleCommunications Unified Inventory Management7.4.0
OracleCommunications Unified Inventory Management7.4.1
OracleCommunications Unified Inventory Management7.4.2
OracleCommunications Unified Inventory Management7.5.0
OracleFinancial Services Analytical Applications Infrastructure>= 8.0.6, <= 8.1.1
OracleFinancial Services Crime And Compliance Management Studio8.0.8.2.0
OracleFinancial Services Crime And Compliance Management Studio8.0.8.3.0
OracleFinancial Services Enterprise Case ManagementAll versions
OracleFinancial Services Enterprise Case Management8.0.7.2.0
OracleFinancial Services Enterprise Case Management8.0.8.1.0
OracleFlexcube Universal Banking>= 14.0.0, <= 14.3.0
OracleFlexcube Universal Banking12.4
OracleFlexcube Universal Banking14.5
OracleHealthcare Data Repository8.1.0
OracleInsurance Policy Administration11.0.2
OracleInsurance Policy Administration11.1.0
OracleInsurance Policy Administration11.2.8
OracleInsurance Policy Administration11.3.0

Showing 50 of 70 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-36090?
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
How severe is CVE-2021-36090?
CVE-2021-36090 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 13.29% probability of exploitation in the next 30 days.
How do I fix CVE-2021-36090?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-36090?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST