CVE-2021-36374
Medium
Description
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Apache Ant
PublishedJul 14, 2021
First seenJul 14, 2021
Weakness typeCWE-130CWE-130
How to fix
Update
- apache ant1.9.16, 1.10.11 or later
- oracle timesten_in-memory_database11.2.2.8.27 or later
- org.apache.ant:ant1.9.16, 1.10.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache ant | 1.9.0 ≤ v < 1.9.16, 1.10.0 ≤ v < 1.10.11 | 1.9.16, 1.10.11 |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle agile_product_lifecycle_management | 9.3.6 | — |
| oracle banking_trade_finance | 14.5 | — |
| oracle banking_treasury_management | 14.5 | — |
| oracle communications_cloud_native_core_automated_test_suite | 1.9.0 | — |
| oracle communications_cloud_native_core_binding_support_function | 1.11.0 | — |
| oracle communications_diameter_intelligence_hub | 8.0.0 ≤ v ≤ 8.1.0, 8.2.0 ≤ v ≤ 8.2.3 | — |
| oracle communications_order_and_service_management | 7.3, 7.4 | — |
| oracle communications_unified_inventory_management | 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.5.0 | — |
| oracle enterprise_repository | 11.1.1.7.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6 ≤ v ≤ 8.1.1 | — |
| oracle health_sciences_information_manager | 3.0.1 ≤ v ≤ 3.0.5, 3.0.0.1 | — |
| oracle insurance_policy_administration | 11.0 ≤ v ≤ 11.3.1 | — |
| oracle primavera_gateway | 17.12.0 ≤ v ≤ 17.12.11, 18.8.0 ≤ v ≤ 18.8.12, 19.12.0 ≤ v ≤ 19.12.11, 20.12.0 ≤ v ≤ 20.12.7 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 18.8, 19.12, 20.12 | — |
| oracle product_lifecycle_analytics | 3.6.1 | — |
| oracle real-time_decision_server | 3.2.0.0, 11.1.1.9.0 | — |
| oracle retail_advanced_inventory_planning | 14.1, 15.0, 16.0 | — |
| oracle retail_back_office | 14.0, 14.1 | — |
| oracle retail_bulk_data_integration | 16.0.3.0, 19.0.1 | — |
| oracle retail_central_office | 14.0, 14.1 | — |
| oracle retail_eftlink | 19.0.1, 20.0.1 | — |
| oracle retail_extract_transform_and_load | 13.2.8 | — |
| oracle retail_financial_integration | 14.1.3.2, 15.0.4.0, 16.0.3.0 | — |
| oracle retail_integration_bus | 14.1.3.2, 15.0.4.0, 16.0.3.0, 19.0.1.0 | — |
| oracle retail_invoice_matching | 16.0.3 | — |
| oracle retail_merchandising_system | 19.0.1 | — |
| oracle retail_point-of-service | 14.0, 14.1 | — |
| oracle retail_predictive_application_server | 14.1.3, 15.0.3, 16.0.3.0 | — |
| oracle retail_service_backbone | 14.1.3.2, 15.0.4.0, 16.0.3.0, 19.0.1.0 | — |
| oracle retail_store_inventory_management | 14.1, 15.0, 16.0 | — |
| oracle retail_xstore_point_of_service | 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1 | — |
| oracle timesten_in-memory_database | v < 11.2.2.8.27 | 11.2.2.8.27 |
| oracle utilities_framework | 4.3.0.1.0 ≤ v ≤ 4.3.0.6.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | — |
| oracle utilities_testing_accelerator | 6.0.0.1.1 | — |
| org.apache.ant:antMaven | 1.9.0 ≤ v < 1.9.16, 1.10.0 ≤ v < 1.10.11 | 1.9.16, 1.10.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.