Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3130
Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress
affect WebSphere Application Server Liberty (CVE-2021-33517,
CVE-2021-36090)
16 September 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: WebSphere Application Server Liberty
Publisher: IBM
Operating System: AIX
HP-UX
IBM i
Linux variants
Solaris
Windows
z/OS
Mac OS
Impact/Access: Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2021-36090 CVE-2021-35517 CVE-2021-33517
Reference: ESB-2021.2651
Original Bulletin:
https://www.ibm.com/support/pages/node/6489683
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect
WebSphere Application Server Liberty (CVE-2021-33517, CVE-2021-36090)
Security Bulletin
Summary
There are multiple vulnerabilities in the Apache Commons Compress library that
is used by WebSphere Application Server Liberty. This has been addressed.
Vulnerability Details
CVEID: CVE-2021-35517
DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service,
caused by an out of memory error when allocating large amounts of memory. By
persuading a victim to open a specially-crafted TAR archive, a remote attacker
could exploit this vulnerability to cause a denial of service condition against
services that use Compress' tar package.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
205307 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVEID: CVE-2021-36090
DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service,
caused by an out-of-memory error when large amounts of memory are allocated. By
reading a specially-crafted ZIP archive, a remote attacker could exploit this
vulnerability to cause a denial of service condition against services that use
Compress' zip package.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
205310 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
+------------------------------------+-------------------+
|Affected Product(s) |Version(s) |
+------------------------------------+-------------------+
|WebSphere Application Server Liberty|17.0.0.3 - 21.0.0.9|
+------------------------------------+-------------------+
Remediation/Fixes
The recommended solution is to apply the interim fix or Fix Pack containing
APAR PH39418 for each named product as soon as practical.
For WebSphere Application Server Liberty 17.0.0.3 - 21.0.0.9:
. Upgrade to minimal fix pack levels as required by interim fix and then apply
Interim Fix PH39418
- --OR--
. Apply Liberty Fix Pack 21.0.0.10 or later (targeted availability 4Q2021).
Additional interim fixes may be available and linked off the interim fix
download page.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
References
Complete CVSS v3 Guide
On-line Calculator v3
Off
Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
Change History
15 Sep 2021: Initial Publication
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYULGDONLKJtyKPYoAQgIRQ/+KaEyKWuqonNkqPvUM6UGmbvuD1LHUjyd
T+LR0RUjf8XyS0tzVIKIrEVUVWDVWrWFMweIAmiEIjIa5utYvLUtXhF5YgnIEPDU
oxM6/vmC24OEIPNKxTYv/TADAl8aV4MtzaM9SqRaQ6O6pNlcNV2brEWlq/f902Em
l039+bGapFRGiWlsl3W47QN6Gh4zanL70mEk2LFw+IP258jBAfY5g13aPnZM7bc3
UVIf6WHN3B8KgG2Z/r/CphVQAlbScJ75LJwWzvsfsLmcFtDOpFWkJMMxgFTeQ88H
E+6FKQCG05a3vQNh3pCarVe0tl6zkTBNpcFaY6AagFhIimlIK7vwSDBk71SOgEZe
3We8oxhAxzcOkbwVREZnEpwv5bXX9KgX6g+J2TLDfQA4CZCHHPg+6uigecK04C9a
95VAsnEHU130JzXqvG0zYrkKh3+nuvy/i4goWHIleLA0wCt57LVLMi5b09HPv7D3
R9luU5WaywAeDfP/Kt3TtyRXrMeFjyI+CvYGxWuyZzXYfDt6lK+qnXw9VCynyP2+
opvyBgkIulxaSsThq35UAslxXiN9g7Oo4lkLsnErwcv95J9WYIlEvK4twzZeeAKn
dWs4MfPM78fKo1e15UwHbodhwORwW3d34BYMzSqw61LIwlduVY0SvOV+vE5GKxjy
/MgUYsljPbs=
=Spn/
-----END PGP SIGNATURE-----