CVE-2021-36373
published 2021-07-14CVE-2021-36373: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error…
PriorityP424medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
2.52%
84.7th percentile
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Affected
83 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ant | >= 0 < 1.10.11-1 | 1.10.11-1 |
| apache | ant | >= 0 < 1.10.11-1 | 1.10.11-1 |
| apache | ant | >= 0 < 1.10.11-1 | 1.10.11-1 |
| apache | ant | >= 1.10.0 < 1.10.11 | 1.10.11 |
| apache | ant | >= 1.9.0 < 1.9.16 | 1.9.16 |
| apache_software_foundation | apache_ant | Apache Ant 1.10.x – 1.10.10 | — |
| apache_software_foundation | apache_ant | Apache Ant 1.9.x – 1.9.15 | — |
| debian | ant | < ant 1.10.11-1 (bookworm) | ant 1.10.11-1 (bookworm) |
| msrc | azl3_javapackages-bootstrap_1.14.0-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_javapackages-bootstrap_1.5.0-4_on_azure_linux_3.0 | — | — |
| msrc | cbl2_javapackages-bootstrap_1.5.0-6_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_ant_1.10.11-1_on_cbl_mariner_1.0 | — | — |
| oracle | agile_product_lifecycle_management | — | — |
| oracle | banking_trade_finance | — | — |
| oracle | banking_treasury_management | — | — |
| oracle | communications_cloud_native_core_automated_test_suite | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_order_and_service_management | — | — |
| oracle | communications_order_and_service_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | enterprise_repository | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_msrc5.5MEDIUM
vendor_oracle5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Handling of Length Parameter Inconsistency in Apache Ant
osv·2021-08-02
CVE-2021-36373 [MEDIUM] Improper Handling of Length Parameter Inconsistency in Apache Ant
Improper Handling of Length Parameter Inconsistency in Apache Ant
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
GHSA
Improper Handling of Length Parameter Inconsistency in Apache Ant
ghsa·2021-08-02
CVE-2021-36373 [MEDIUM] CWE-130 Improper Handling of Length Parameter Inconsistency in Apache Ant
Improper Handling of Length Parameter Inconsistency in Apache Ant
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
OSV
CVE-2021-36373: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memor
osv·2021-07-14·CVSS 5.5
CVE-2021-36373 [MEDIUM] CVE-2021-36373: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memor
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Oracle
Oracle Oracle JD Edwards Risk Matrix: Deployment SEC (Apache Ant) — CVE-2021-36373
vendor_oracle·2023-04-15·CVSS 5.5
CVE-2021-36373 [MEDIUM] Oracle Oracle JD Edwards Risk Matrix: Deployment SEC (Apache Ant) — CVE-2021-36373
Oracle Oracle JD Edwards Risk Matrix: Deployment SEC (Apache Ant) vulnerability
CVE: CVE-2021-36373
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2023 (APR 2023)
Red Hat
ant: excessive memory allocation when reading a specially crafted TAR archive
vendor_redhat·2021-07-13·CVSS 5.5
CVE-2021-36373 [MEDIUM] CWE-770 ant: excessive memory allocation when reading a specially crafted TAR archive
ant: excessive memory allocation when reading a specially crafted TAR archive
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Statement: OpenShift Container Platform 4 (OCP) ships affected version of Apache Ant in the ose-metering-hive container, however the metering operator is deprecated since 4.6[1]. This issue is not currently planned to be addressed in future updates and hence ose-metering-hive container has been marked as 'will not fix'.
[1] https://docs.openshift.com/container-platform/4.6/metering/metering-about-metering.html
Package: ant (Re
Microsoft
Apache Ant TAR archive denial of service vulnerability
vendor_msrc·2021-07-13·CVSS 5.5
CVE-2021-36373 [MEDIUM] CWE-130 Apache Ant TAR archive denial of service vulnerability
Apache Ant TAR archive denial of service vulnerability
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lear
Debian
CVE-2021-36373: ant - When reading a specially crafted TAR archive an Apache Ant build can be made to ...
vendor_debian·2021·CVSS 5.5
CVE-2021-36373 [MEDIUM] CVE-2021-36373: ant - When reading a specially crafted TAR archive an Apache Ant build can be made to ...
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Scope: local
bookworm: resolved (fixed in 1.10.11-1)
bullseye: open
forky: resolved (fixed in 1.10.11-1)
sid: resolved (fixed in 1.10.11-1)
trixie: resolved (fixed in 1.10.11-1)
No detection rules found.
No public exploits indexed.
https://ant.apache.org/security.htmlhttps://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3Ehttps://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210819-0007/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://ant.apache.org/security.htmlhttps://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3Ehttps://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210819-0007/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-07-14
Published