PT-2021-3616 · Apache+3 · Apache Ant+3

Published 2021-07-14 · Updated 2024-09-17 · CVE-2021-36373

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Ant versions prior to 1.9.16 Apache Ant versions prior to 1.10.11

Description The issue is related to an uncontrolled resource consumption in the Apache Ant utility. It can be exploited by a remote attacker to cause a denial of service. When reading a specially crafted TAR archive, an Apache Ant build can allocate large amounts of memory, leading to an out of memory error, even for small inputs. This can disrupt builds using Apache Ant.

Recommendations For Apache Ant versions prior to 1.9.16, update to version 1.9.16 or later. For Apache Ant versions prior to 1.10.11, update to version 1.10.11 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-130

Related Identifiers

ALT-PU-2024-17640

AZL-25953

AZL-34808

BDU:2021-03752

CVE-2021-36373

GHSA-Q5R4-CFPX-H6FH

OESA-2021-1277

OPENSUSE-SU-2022_1418-1

OPENSUSE-SU-2024:11688-1

SUSE-SU-2022:1417-1

SUSE-SU-2022:1418-1

SUSE-SU-2022_1417-1

SUSE-SU-2022_1418-1

Affected Products

Alt Linux

Apache Ant

Debian

Suse

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2021-36374 · Security Note
• https://osv.dev/vulnerability/AZL-25953 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36373 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://osv.dev/vulnerability/SUSE-SU-2022:1417-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11688-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://ubuntu.com/security/CVE-2021-36373 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-36373 · Security Note
• https://ant.apache.org/security.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36373 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-36373 · Vendor Advisory