CVE-2021-35516 in dependency org.apache.commons:commons-compress

Situation

Testcontainers depends on org.apache.commons:commons-compress version 1.20, which has a reported vulnerability CVE-2021-35516. Specially crafted archives can be used to allocate large amounts of memory, resulting in DoS.

Solution

Please update dependency:

<dependency>
  <groupId>org.apache.commons</groupId>
  <artifactId>commons-compress</artifactId>
  <version>1.21</version>
</dependency>

[kiview]

Thanks for bringing this to our attention @redcatbear.

Please note that this is not an attack vector for normal Testcontainer usage scenarios and is unlikely to have exploitable consequences.

[redcatbear]

Thanks for recognizing the issue. I agree that the use case for an exploit is not the typical testcontainer scenario. Still it is a good idea to keep ones software as clean as possible and the fix in this case is luckily trivial.