NexaPulse
Subscribe
5.5mediumMedium

CVE-2021-36373

Apache Ant

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, someone has to be persuaded to take an action first.

Scoring

CVSS
5.5 (v3.1)
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-130
Assigned by
security@apache.org

Dates

Published
2021-07-14
Last modified
2026-08-25
Sources
NVD

Affected products

  • Apache Ant1.9.0 - 1.9.16, 1.10.0 - 1.10.11
  • Oracle Agile Product Lifecycle Management9.3.6
  • Oracle Banking Trade Finance14.5
  • Oracle Banking Treasury Management14.5
  • Oracle Communications Cloud Native Core Automated Test Suite1.9.0
  • Oracle Communications Cloud Native Core Binding Support Function1.11.0
  • Oracle Communications Order And Service Management7.3, 7.4
  • Oracle Communications Unified Inventory Management7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.5.0
  • Oracle Enterprise Repository11.1.1.7.0
  • Oracle Financial Services Analytical Applications Infrastructure8.0.6 - 8.1.1
  • Oracle Insurance Policy Administration11.0 - 11.3.1
  • Oracle Primavera Gateway17.12.0 - 17.12.11, 18.8.0 - 18.8.12, 19.12.0 - 19.12.11, 20.12.0 - 20.12.7

As listed in the NVD configuration data. Not a statement about your estate.

References