Medium severity · published Jul 14, 2021
CVE-2021-36374
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even…
5.5
CVSS
2.6%
EPSS
No
On KEV
Description
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.6 · source: NVD
AN
Ant · Apache
1.9.0 before 1.9.16; 1.10.0 before 1.10.11 · source: NVD
BT
Banking Trade Finance · Oracle
14.5 · source: NVD
BT
Banking Treasury Management · Oracle
14.5 · source: NVD
CC
Communications Cloud Native Core Automated Test Suite · Oracle
1.9.0 · source: NVD
CC
Communications Cloud Native Core Binding Support Function · Oracle
1.11.0 · source: NVD
CD
Communications Diameter Intelligence Hub · Oracle
8.0.0 through 8.1.0; 8.2.0 through 8.2.3 · source: NVD
CO
Communications Order And Service Management · Oracle
7.3; 7.4 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.3.0; 7.4.0; 7.4.1; 7.4.2; 7.5.0 · source: NVD
ER
Enterprise Repository · Oracle
11.1.1.7.0 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.6 through 8.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-36374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-36374
Patch
https://ant.apache.org/security.html
lists.apache.org
https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
Mailing List
https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
More from Ant
7.5
CVE-2020-11979
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them
7.4
CVE-2026-78254
Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
6.3
CVE-2020-1945
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak…
5.5
CVE-2021-36373
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small…