CVE-2021-36373

Опубликовано: 14 июл. 2021

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:*

Версия от 1.9.0 (включая) до 1.9.16 (исключая)

cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:*

Версия от 1.10.0 (включая) до 1.10.11 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*

Версия от 8.0.6 (включая) до 8.1.1 (включая)

cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*

Версия от 11.0 (включая) до 11.3.1 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 17.12.0 (включая) до 17.12.11 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 18.8.0 (включая) до 18.8.12 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 19.12.0 (включая) до 19.12.11 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 20.12.0 (включая) до 20.12.7 (включая)

cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*

Версия от 17.7 (включая) до 17.12 (включая)

cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*

cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*

Версия до 11.2.2.8.27 (исключая)

cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*

Версия от 4.3.0.1.0 (включая) до 4.3.0.6.0 (включая)

cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.02532

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-130

NVD-CWE-Other

Связанные уязвимости

CVE-2021-36373

CVSS3: 5.5

ubuntu

около 5 лет назад

CVE-2021-36373

CVSS3: 5.5

redhat

около 5 лет назад

CVE-2021-36373

CVSS3: 5.5

msrc

6 месяцев назад

Apache Ant TAR archive denial of service vulnerability

CVE-2021-36373

CVSS3: 5.5

debian

около 5 лет назад

When reading a specially crafted TAR archive an Apache Ant build can b ...

GHSA-q5r4-cfpx-h6fh

CVSS3: 5.5

github

около 5 лет назад

Improper Handling of Length Parameter Inconsistency in Apache Ant

EPSS

Процентиль: 83%

0.02532

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-130

NVD-CWE-Other