← Back

CVE-2021-36373

nvd nist
Published: Jul 14, 2021Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Affected (73)

Products: Apache: Ant · Oracle: Agile Plm, Banking Trade Finance, Banking Treasury Management, Communications Cloud Native Core Automated Test Suite, Communications Cloud Native Core Binding Support Function, Communications Order And Service Management, Communications Unified Inventory Management, Enterprise Repository, Financial Services Analytical Applications Infrastructure, Insurance Policy Administration, Primavera Gateway, Primavera Unifier, Real Time Decision Server, Retail Advanced Inventory Planning, Retail Back Office, Retail Bulk Data Integration, Retail Central Office, Retail Eftlink, Retail Extract Transform And Load, Retail Financial Integration, Retail Integration Bus, Retail Invoice Matching, Retail Merchandising System, Retail Point Of Service, Retail Predictive Application Server, Retail Service Backbone, Retail Store Inventory Management, Retail Xstore Point Of Service, Timesten In Memory Database, Utilities Framework, Utilities Testing Accelerator
Apache
1 product
Ant
Oracle
31 products
Agile Plm
Banking Trade Finance
Banking Treasury Management
Communications Cloud Native Core Automated Test Suite
Communications Cloud Native Core Binding Support Function
Communications Order And Service Management
Communications Unified Inventory Management
Enterprise Repository
Financial Services Analytical Applications Infrastructure
Insurance Policy Administration
Primavera Gateway
Primavera Unifier
Real Time Decision Server
Retail Advanced Inventory Planning
Retail Back Office
Retail Bulk Data Integration
Retail Central Office
Retail Eftlink
Retail Extract Transform And Load
Retail Financial Integration
Retail Integration Bus
Retail Invoice Matching
Retail Merchandising System
Retail Point Of Service
Retail Predictive Application Server
Retail Service Backbone
Retail Store Inventory Management
Retail Xstore Point Of Service
Timesten In Memory Database
Utilities Framework
Utilities Testing Accelerator
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Ant
From 1.10.0 to 1.10.11
Ant
From 1.9.0 to 1.9.16
Configuration B
71 vulnerable
Vulnerable SoftwareAffected Versions
Agile Plm
Version 9.3.6
Banking Trade Finance
Version 14.5
Banking Treasury Management
Version 14.5
Communications Cloud Native Core Automated Test Suite
Version 1.9.0
Communications Cloud Native Core Binding Support Function
Version 1.11.0
Oracle
Communications Order And Service Management
Version 7.3
Communications Order And Service Management
Version 7.4
Oracle
Communications Unified Inventory Management
Version 7.3.0
Communications Unified Inventory Management
Version 7.4.0
Communications Unified Inventory Management
Version 7.4.1
Communications Unified Inventory Management
Version 7.4.2
Communications Unified Inventory Management
Version 7.5.0
Enterprise Repository
Version 11.1.1.7.0
Financial Services Analytical Applications Infrastructure
From 8.0.6 to 8.1.1
Insurance Policy Administration
From 11.0 to 11.3.1
Oracle
Primavera Gateway
From 17.12.0 to 17.12.11
Primavera Gateway
From 18.8.0 to 18.8.12
Primavera Gateway
From 19.12.0 to 19.12.11
Primavera Gateway
From 20.12.0 to 20.12.7
Oracle
Primavera Unifier
From 17.7 to 17.12
Primavera Unifier
Version 18.8
Primavera Unifier
Version 19.12
Primavera Unifier
Version 20.12
Oracle
Real Time Decision Server
Version 11.1.1.9.0
Real Time Decision Server
Version 3.2.0.0
Oracle
Retail Advanced Inventory Planning
Version 14.1
Retail Advanced Inventory Planning
Version 15.0
Retail Advanced Inventory Planning
Version 16.0
Oracle
Retail Back Office
Version 14.0
Retail Back Office
Version 14.1
Oracle
Retail Bulk Data Integration
Version 16.0.3.0
Retail Bulk Data Integration
Version 19.0.1
Oracle
Retail Central Office
Version 14.0
Retail Central Office
Version 14.1
Oracle
Retail Eftlink
Version 19.0.1
Retail Eftlink
Version 20.0.1
Retail Extract Transform And Load
Version 13.2.8
Oracle
Retail Financial Integration
Version 14.1.3.2
Retail Financial Integration
Version 15.0.4.0
Retail Financial Integration
Version 16.0.3.0
Oracle
Retail Integration Bus
Version 14.1.3.2
Retail Integration Bus
Version 15.0.4.0
Retail Integration Bus
Version 16.0.3.0
Retail Integration Bus
Version 19.0.1.0
Retail Invoice Matching
Version 16.0.3
Retail Merchandising System
Version 19.0.1
Oracle
Retail Point Of Service
Version 14.0
Retail Point Of Service
Version 14.1
Oracle
Retail Predictive Application Server
Version 14.1.3
Retail Predictive Application Server
Version 15.0.3
Retail Predictive Application Server
Version 16.0.3.0
Oracle
Retail Service Backbone
Version 14.1.3.2
Retail Service Backbone
Version 15.0.4.0
Retail Service Backbone
Version 16.0.3.0
Retail Service Backbone
Version 19.0.1.0
Oracle
Retail Store Inventory Management
Version 14.1
Retail Store Inventory Management
Version 15.0
Retail Store Inventory Management
Version 16.0
Oracle
Retail Xstore Point Of Service
Version 16.0.6
Retail Xstore Point Of Service
Version 17.0.4
Retail Xstore Point Of Service
Version 18.0.3
Retail Xstore Point Of Service
Version 19.0.2
Retail Xstore Point Of Service
Version 20.0.1
Timesten In Memory Database
Before 11.2.2.8.27
Oracle
Utilities Framework
From 4.3.0.1.0 to 4.3.0.6.0
Utilities Framework
Version 4.2.0.2.0
Utilities Framework
Version 4.2.0.3.0
Utilities Framework
Version 4.4.0.0.0
Utilities Framework
Version 4.4.0.2.0
Utilities Framework
Version 4.4.0.3.0
Utilities Testing Accelerator
Version 6.0.0.1.1

Related CWEs

CWE-130
Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

References (22)

Source: security@apache.org
PatchVendor Advisory
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Mailing ListVendor Advisory
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
Not Applicable
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.