CVE-2021-36090 @ Maven-org.apache.commons:commons-compress-1.15

[cxronen]

Vulnerable Package issue exists @ Maven-org.apache.commons:commons-compress-1.15 in branch main

When reading a specially crafted ZIP archive, Compress before 1.21 can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Namespace: cxronen
Repository: BookStore
Repository Url: https://github.com/cxronen/BookStore
CxAST-Project: cxronen/BookStore
CxAST platform scan: 207c1944-f9e8-4bbb-a51e-1235c29a4b44
Branch: main
Application: BookStore
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-130

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: 1.21

---

References
Advisory
Release Note
Mail Thread
Commit
Commit