Atlassian Confluence: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• High 7.5
  CVE-2019-12402 EPSS 16%

  Denial of Service in Apache Commons Compress

  The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an …

  Apache Software Foundation Apache Commons Compress libcommons-compress-java org.apache.commons:commons-compress Debian Ubuntu Maven
  Aug 29, 2019
• High 7.5
  CVE-2021-35515 EPSS 12%

  Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

  When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

  Apache Software Foundation Apache Commons Compress org.apache.commons:commons-compress libcommons-compress-java Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.5
  CVE-2021-35516 EPSS 12%

  Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

  When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Com…

  Apache Software Foundation Apache Commons Compress org.apache.commons:commons-compress libcommons-compress-java Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.5
  CVE-2021-35517 EPSS 11%

  Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

  When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Co…

  Apache Software Foundation Apache Commons Compress org.apache.commons:commons-compress libcommons-compress-java Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.5
  CVE-2021-36090 EPSS 13%

  Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

  When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Co…

  Apache Software Foundation Apache Commons Compress libcommons-compress-java org.apache.commons:commons-compress Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.3
  CVE-2024-21686

  This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This …

  Atlassian Confluence Server Confluence Data Center Web / CMS
  Jul 16, 2024
• Unscored —
  CVE-2024-21688 Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Jan 1, 2024

Revision history

1. 2024-07-16 #1

   Initiale Fassung

References

• Confluence Public Security Vulnerability vom 2024-07-16
  https://jira.atlassian.com/browse/CONFSERVER-96103
• Confluence Public Security Vulnerability vom 2024-07-16
  https://jira.atlassian.com/browse/CONFSERVER-96102
• Confluence Public Security Vulnerability vom 2024-07-16
  https://jira.atlassian.com/browse/CONFSERVER-96101
• Confluence Public Security Vulnerability vom 2024-07-16
  https://jira.atlassian.com/browse/CONFSERVER-96100
• Confluence Public Security Vulnerability vom 2024-07-16
  https://jira.atlassian.com/browse/CONFSERVER-96099
• Confluence Public Security Vulnerability vom 2024-07-16
  https://jira.atlassian.com/browse/CONFSERVER-96135
• Confluence Public Security Vulnerability vom 2024-07-16
  https://jira.atlassian.com/browse/CONFSERVER-96134
• Atlassian Security Bulletin vom 2024-07-16
  https://confluence.atlassian.com/security/security-bulletin-july-16-2024-1417150917.html