Ant vulnerability 

Issue date: 21-09-2021
Affects versions: 14.6

Security Issue ID

SECURITY-244

 

Affected Product Version(s)

14.6.0 and previous releases.

Severity 

medium

Description

CVE-2021-36373

 

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

NVD-CWE-Other

CVSSv2:

• Base Score: MEDIUM (4.3)
• Vector: /AV:N/AC:M/Au:N/C:N/I:N/A

CVSSv3:

• Base Score: MEDIUM (5.5)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

 

CVE-2021-36374

 

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

NVD-CWE-Other

CVSSv2:

• Base Score: MEDIUM (4.3)
• Vector: /AV:N/AC:M/Au:N/C:N/I:N/A

CVSSv3:

• Base Score: MEDIUM (5.5)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Instructions

Customers using the 14.x major versions are recommended to upgrade to the latest version in that series.