Improper Handling of Length Parameter Inconsistency in Apache Ant

MEDIO 5.5CVE-2021-36373 · GHSA-q5r4-cfpx-h6fh · Published 14/07/2021 · updated 25/08/2026

In breve

CVE-2021-36373 è una vulnerabilità MEDIO (CVSS 5.5) che riguarda org.apache.ant:ant, ant (apache), agile product lifecycle management (oracle).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.5%, superiore al 84.9% delle vulnerabilità.
Correzione: aggiornare a 1.10.11, 1.9.16, 11.2.2.8.27 o successiva.

Package	Affected versions	Patched versions
org.apache.ant:ant Maven	`≥ 1.10.0, < 1.10.11< 1.9.16`	`1.10.111.9.16`
ant apache	`≥ 1.10.0, < 1.10.11≥ 1.9.0, < 1.9.16`	`1.10.111.9.16`
agile product lifecycle management oracle	`= 9.3.6`	No fix yet
banking trade finance oracle	`= 14.5`	No fix yet
banking treasury management oracle	`= 14.5`	No fix yet
communications cloud native core automated test suite oracle	`= 1.9.0`	No fix yet
communications cloud native core binding support function oracle	`= 1.11.0`	No fix yet
communications order and service management oracle	`= 7.3= 7.4`	No fix yet
communications unified inventory management oracle	`= 7.3.0= 7.4.0= 7.4.1= 7.4.2= 7.5.0`	No fix yet
enterprise repository oracle	`= 11.1.1.7.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.1.1`	No fix yet
insurance policy administration oracle	`≥ 11.0, ≤ 11.3.1`	No fix yet
primavera gateway oracle	`≥ 17.12.0, ≤ 17.12.11≥ 18.8.0, ≤ 18.8.12≥ 19.12.0, ≤ 19.12.11≥ 20.12.0, ≤ 20.12.7`	No fix yet
primavera unifier oracle	`= 18.8= 19.12= 20.12≥ 17.7, ≤ 17.12`	No fix yet
real-time decision server oracle	`= 11.1.1.9.0= 3.2.0.0`	No fix yet
retail advanced inventory planning oracle	`= 14.1= 15.0= 16.0`	No fix yet
retail back office oracle	`= 14.0= 14.1`	No fix yet
retail bulk data integration oracle	`= 16.0.3.0= 19.0.1`	No fix yet
retail central office oracle	`= 14.0= 14.1`	No fix yet
retail eftlink oracle	`= 19.0.1= 20.0.1`	No fix yet
retail extract transform and load oracle	`= 13.2.8`	No fix yet
retail financial integration oracle	`= 14.1.3.2= 15.0.4.0= 16.0.3.0`	No fix yet
retail integration bus oracle	`= 14.1.3.2= 15.0.4.0= 16.0.3.0= 19.0.1.0`	No fix yet
retail invoice matching oracle	`= 16.0.3`	No fix yet
retail merchandising system oracle	`= 19.0.1`	No fix yet
retail point-of-service oracle	`= 14.0= 14.1`	No fix yet
retail predictive application server oracle	`= 14.1.3= 15.0.3= 16.0.3.0`	No fix yet
retail service backbone oracle	`= 14.1.3.2= 15.0.4.0= 16.0.3.0= 19.0.1.0`	No fix yet
retail store inventory management oracle	`= 14.1= 15.0= 16.0`	No fix yet
retail xstore point of service oracle	`= 16.0.6= 17.0.4= 18.0.3= 19.0.2= 20.0.1`	No fix yet
timesten in-memory database oracle	`< 11.2.2.8.27`	`11.2.2.8.27`
utilities framework oracle	`= 4.2.0.2.0= 4.2.0.3.0= 4.4.0.0.0= 4.4.0.2.0= 4.4.0.3.0≥ 4.3.0.1.0, ≤ 4.3.0.6.0`	No fix yet
utilities testing accelerator oracle	`= 6.0.0.1.1`	No fix yet

Description

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

NVD description

References

Altre vulnerabilità di org.apache.ant:ant

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free