Vulnerability · Published Jul 14, 2021 · Assigned by apache
CVE-2021-36374Apache Ant ZIP, and ZIP based, archive denial of service vulerability
Medium 5.5
In plain English
A medium-severity security flaw in Apache Ant from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | apache-ant | 1.10.11-r0 | ALPINE-CVE-2021-36374 |
| Alpine:v3.21 | apache-ant | 1.10.11-r0 | ALPINE-CVE-2021-36374 |
| Alpine:v3.22 | apache-ant | 1.10.11-r0 | ALPINE-CVE-2021-36374 |
| Alpine:v3.23 | apache-ant | 1.10.11-r0 | ALPINE-CVE-2021-36374 |
| Alpine:v3.24 | apache-ant | 1.10.11-r0 | ALPINE-CVE-2021-36374 |
| Debian:12 | ant | 1.10.11-1 | DEBIAN-CVE-2021-36374 |
| Debian:13 | ant | 1.10.11-1 | DEBIAN-CVE-2021-36374 |
| Debian:14 | ant | 1.10.11-1 | DEBIAN-CVE-2021-36374 |
| Maven | org.apache.ant:ant | 1.10.11 | GHSA-5v34-g2px-j4fw |
| Maven | org.apache.ant:ant | 1.9.16 | GHSA-5v34-g2px-j4fw |
| Ubuntu:22.04:LTS | ant | no fix listed | UBUNTU-CVE-2021-36374 |
| Ubuntu:24.04:LTS | ant | no fix listed | UBUNTU-CVE-2021-36374 |
| Ubuntu:25.10 | ant | no fix listed | UBUNTU-CVE-2021-36374 |
| Ubuntu:26.04:LTS | ant | no fix listed | UBUNTU-CVE-2021-36374 |
| Ubuntu:26.10 | ant | no fix listed | UBUNTU-CVE-2021-36374 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Ant | 1.4 – before Apache Ant*Apache Ant 1.9.x – through 1.9.15Apache Ant 1.10.x – through 1.10.10 |
Weakness: CWE-130
References
- https://ant.apache.org/security.html x_refsource_MISC
- https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E x_refsource_MISC
- [groovy-commits] 20210714 [groovy] 08/09: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374) mailing-list, x_refsource_MLIST
- [groovy-commits] 20210715 [groovy] 02/07: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374) mailing-list, x_refsource_MLIST
- [groovy-notifications] 20210715 [jira] [Resolved] (GROOVY-10169) Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374) mailing-list, x_refsource_MLIST
- [myfaces-dev] 20210830 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #1215: build: CVE fix mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210819-0007/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC