CVE-2021-36373
Apache Ant TAR archive denial of service vulnerability
MEDIUM 5.5
En bref
- Source
- NVD
- EPSS
- EPSS 2.52 % · centile 85 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Modified
Description
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Faiblesses (CWE)
- CWE-130 — Improper Handling of Length Parameter Inconsistency
Références
- https://ant.apache.org/security.html
- https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E
- https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
- https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
- https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
- https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210819-0007/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-q5r4-cfpx-h6fh — Improper Handling of Length Parameter Inconsistency in Apache Ant
Références européennes
- ENISA EUVD · EUVD-2021-1834
- GCVE · GCVE-0-2021-36373
Avis du CERT-FR
- CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0154 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0324 — Multiples vulnérabilités dans Oracle Systems · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:*≥ 1.9.0 < 1.9.16cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:*≥ 1.10.0 < 1.10.11cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*≥ 8.0.6 ≤ 8.1.1cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*≥ 11.0 ≤ 11.3.1cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 17.12.0 ≤ 17.12.11cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 18.8.0 ≤ 18.8.12cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 19.12.0 ≤ 19.12.11cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 20.12.0 ≤ 20.12.7cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*≥ 17.7 ≤ 17.12cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*- +33 autres
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache Ant | affected Apache Ant 1.9.x ≤ 1.9.15 ; affected Apache Ant 1.10.x ≤ 1.10.10 ; unaffected Apache Ant < 1.9.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |