Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-36374

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Published

2021-07-14T07:15:08.400

Last Modified

2024-11-21T06:13:38.083

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-130
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache ant < 1.9.16 Yes
Application apache ant < 1.10.11 Yes
Application oracle agile_engineering_data_management 6.2.1.0 Yes
Application oracle agile_plm 9.3.6 Yes
Application oracle banking_trade_finance 14.5 Yes
Application oracle banking_treasury_management 14.5 Yes
Application oracle communications_cloud_native_core_automated_test_suite 1.9.0 Yes
Application oracle communications_cloud_native_core_binding_support_function 1.11.0 Yes
Application oracle communications_diameter_intelligence_hub ≤ 8.1.0 Yes
Application oracle communications_diameter_intelligence_hub ≤ 8.2.3 Yes
Application oracle communications_order_and_service_management 7.3 Yes
Application oracle communications_order_and_service_management 7.4 Yes
Application oracle communications_unified_inventory_management 7.3.0 Yes
Application oracle communications_unified_inventory_management 7.4.0 Yes
Application oracle communications_unified_inventory_management 7.4.1 Yes
Application oracle communications_unified_inventory_management 7.4.2 Yes
Application oracle communications_unified_inventory_management 7.5.0 Yes
Application oracle enterprise_repository 11.1.1.7.0 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.1.1 Yes
Application oracle health_sciences_information_manager ≤ 3.0.5 Yes
Application oracle health_sciences_information_manager 3.0.0.1 Yes
Application oracle insurance_policy_administration ≤ 11.3.1 Yes
Application oracle primavera_gateway ≤ 17.12.11 Yes
Application oracle primavera_gateway ≤ 18.8.12 Yes
Application oracle primavera_gateway ≤ 19.12.11 Yes
Application oracle primavera_gateway ≤ 20.12.7 Yes
Application oracle primavera_unifier ≤ 17.12 Yes
Application oracle primavera_unifier 18.8 Yes
Application oracle primavera_unifier 19.12 Yes
Application oracle primavera_unifier 20.12 Yes
Application oracle product_lifecycle_analytics 3.6.1 Yes
Application oracle real-time_decision_server 3.2.0.0 Yes
Application oracle real-time_decision_server 11.1.1.9.0 Yes
Application oracle retail_advanced_inventory_planning 14.1 Yes
Application oracle retail_advanced_inventory_planning 15.0 Yes
Application oracle retail_advanced_inventory_planning 16.0 Yes
Application oracle retail_back_office 14.0 Yes
Application oracle retail_back_office 14.1 Yes
Application oracle retail_bulk_data_integration 16.0.3.0 Yes
Application oracle retail_bulk_data_integration 19.0.1 Yes
Application oracle retail_central_office 14.0 Yes
Application oracle retail_central_office 14.1 Yes
Application oracle retail_eftlink 19.0.1 Yes
Application oracle retail_eftlink 20.0.1 Yes
Application oracle retail_extract_transform_and_load 13.2.8 Yes
Application oracle retail_financial_integration 14.1.3.2 Yes
Application oracle retail_financial_integration 15.0.4.0 Yes
Application oracle retail_financial_integration 16.0.3.0 Yes
Application oracle retail_integration_bus 14.1.3.2 Yes
Application oracle retail_integration_bus 15.0.4.0 Yes
Application oracle retail_integration_bus 16.0.3.0 Yes
Application oracle retail_integration_bus 19.0.1.0 Yes
Application oracle retail_invoice_matching 16.0.3 Yes
Application oracle retail_merchandising_system 19.0.1 Yes
Application oracle retail_point-of-service 14.0 Yes
Application oracle retail_point-of-service 14.1 Yes
Application oracle retail_predictive_application_server 14.1.3 Yes
Application oracle retail_predictive_application_server 15.0.3 Yes
Application oracle retail_predictive_application_server 16.0.3.0 Yes
Application oracle retail_service_backbone 14.1.3.2 Yes
Application oracle retail_service_backbone 15.0.4.0 Yes
Application oracle retail_service_backbone 16.0.3.0 Yes
Application oracle retail_service_backbone 19.0.1.0 Yes
Application oracle retail_store_inventory_management 14.1 Yes
Application oracle retail_store_inventory_management 15.0 Yes
Application oracle retail_store_inventory_management 16.0 Yes
Application oracle retail_xstore_point_of_service 16.0.6 Yes
Application oracle retail_xstore_point_of_service 17.0.4 Yes
Application oracle retail_xstore_point_of_service 18.0.3 Yes
Application oracle retail_xstore_point_of_service 19.0.2 Yes
Application oracle retail_xstore_point_of_service 20.0.1 Yes
Application oracle timesten_in-memory_database < 11.2.2.8.27 Yes
Application oracle utilities_framework ≤ 4.3.0.6.0 Yes
Application oracle utilities_framework 4.2.0.2.0 Yes
Application oracle utilities_framework 4.2.0.3.0 Yes
Application oracle utilities_framework 4.4.0.0.0 Yes
Application oracle utilities_framework 4.4.0.2.0 Yes
Application oracle utilities_framework 4.4.0.3.0 Yes
Application oracle utilities_testing_accelerator 6.0.0.1.1 Yes
References