Loop with Unreachable Exit Condition ('Infinite Loop') The advisory has been revoked - it doesn't affect any version of package apache-commons-compress-javadoc (opens in a new tab)

Threat Intelligence

11.57% (96^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL8-APACHECOMMONSCOMPRESSJAVADOC-1364063
published26 Jul 2021
disclosed13 Jul 2021

Report a new vulnerability Found a mistake?

Introduced: 13 Jul 2021

CVE-2021-35515 (opens in a new tab) CWE-835 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache-commons-compress-javadoc package and not the apache-commons-compress-javadoc package as distributed by RHEL.

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.