5.5
CVE-2021-36373
- EPSS 2.53%
- Veröffentlicht 14.07.2021 07:15:08
- Zuletzt bearbeitet 25.08.2026 16:28:27
- Erkennungen
LoginApache Ant TAR archive denial of service vulnerability
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Agile Product Lifecycle Management Version 9.3.6
Oracle ≫ Banking Trade Finance Version 14.5
Oracle ≫ Banking Treasury Management Version 14.5
Oracle ≫ Communications Cloud Native Core Automated Test Suite Version 1.9.0
Oracle ≫ Communications Cloud Native Core Binding Support Function Version 1.11.0
Oracle ≫ Communications Order And Service Management Version 7.3
Oracle ≫ Communications Order And Service Management Version 7.4
Oracle ≫ Communications Unified Inventory Management Version 7.3.0
Oracle ≫ Communications Unified Inventory Management Version 7.4.0
Oracle ≫ Communications Unified Inventory Management Version 7.4.1
Oracle ≫ Communications Unified Inventory Management Version 7.4.2
Oracle ≫ Communications Unified Inventory Management Version 7.5.0
Oracle ≫ Enterprise Repository Version 11.1.1.7.0
Oracle ≫ Financial Services Analytical Applications Infrastructure Version >= 8.0.6 <= 8.1.1
Oracle ≫ Insurance Policy Administration Version >= 11.0 <= 11.3.1
Oracle ≫ Primavera Gateway Version >= 17.12.0 <= 17.12.11
Oracle ≫ Primavera Gateway Version >= 18.8.0 <= 18.8.12
Oracle ≫ Primavera Gateway Version >= 19.12.0 <= 19.12.11
Oracle ≫ Primavera Gateway Version >= 20.12.0 <= 20.12.7
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version 18.8
Oracle ≫ Primavera Unifier Version 19.12
Oracle ≫ Primavera Unifier Version 20.12
Oracle ≫ Real-time Decision Server Version 3.2.0.0
Oracle ≫ Real-time Decision Server Version 11.1.1.9.0
Oracle ≫ Retail Advanced Inventory Planning Version 14.1
Oracle ≫ Retail Advanced Inventory Planning Version 15.0
Oracle ≫ Retail Advanced Inventory Planning Version 16.0
Oracle ≫ Retail Back Office Version 14.0
Oracle ≫ Retail Back Office Version 14.1
Oracle ≫ Retail Bulk Data Integration Version 16.0.3.0
Oracle ≫ Retail Bulk Data Integration Version 19.0.1
Oracle ≫ Retail Central Office Version 14.0
Oracle ≫ Retail Central Office Version 14.1
Oracle ≫ Retail Eftlink Version 19.0.1
Oracle ≫ Retail Eftlink Version 20.0.1
Oracle ≫ Retail Extract Transform And Load Version 13.2.8
Oracle ≫ Retail Financial Integration Version 14.1.3.2
Oracle ≫ Retail Financial Integration Version 15.0.4.0
Oracle ≫ Retail Financial Integration Version 16.0.3.0
Oracle ≫ Retail Integration Bus Version 14.1.3.2
Oracle ≫ Retail Integration Bus Version 15.0.4.0
Oracle ≫ Retail Integration Bus Version 16.0.3.0
Oracle ≫ Retail Integration Bus Version 19.0.1.0
Oracle ≫ Retail Invoice Matching Version 16.0.3
Oracle ≫ Retail Merchandising System Version 19.0.1
Oracle ≫ Retail Point-of-service Version 14.0
Oracle ≫ Retail Point-of-service Version 14.1
Oracle ≫ Retail Predictive Application Server Version 14.1.3
Oracle ≫ Retail Predictive Application Server Version 15.0.3
Oracle ≫ Retail Predictive Application Server Version 16.0.3.0
Oracle ≫ Retail Service Backbone Version 14.1.3.2
Oracle ≫ Retail Service Backbone Version 15.0.4.0
Oracle ≫ Retail Service Backbone Version 16.0.3.0
Oracle ≫ Retail Service Backbone Version 19.0.1.0
Oracle ≫ Retail Store Inventory Management Version 14.1
Oracle ≫ Retail Store Inventory Management Version 15.0
Oracle ≫ Retail Store Inventory Management Version 16.0
Oracle ≫ Retail Xstore Point Of Service Version 16.0.6
Oracle ≫ Retail Xstore Point Of Service Version 17.0.4
Oracle ≫ Retail Xstore Point Of Service Version 18.0.3
Oracle ≫ Retail Xstore Point Of Service Version 19.0.2
Oracle ≫ Retail Xstore Point Of Service Version 20.0.1
Oracle ≫ Timesten In-memory Database Version < 11.2.2.8.27
Oracle ≫ Utilities Framework Version >= 4.3.0.1.0 <= 4.3.0.6.0
Oracle ≫ Utilities Framework Version 4.2.0.2.0
Oracle ≫ Utilities Framework Version 4.2.0.3.0
Oracle ≫ Utilities Framework Version 4.4.0.0.0
Oracle ≫ Utilities Framework Version 4.4.0.2.0
Oracle ≫ Utilities Framework Version 4.4.0.3.0
Oracle ≫ Utilities Testing Accelerator Version 6.0.0.1.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.53% | 0.833 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
CWE-130 Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://ant.apache.org/security.html
https://security.netapp.com/advisory/ntap-20210819-0007/
https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E
https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E