Vulnerability Name:

CVE-2021-36374 (CCN-205314)

Assigned:2021-07-13
Published:2021-07-13
Updated:2023-02-28
Summary:Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted ZIP archive, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-36374

Source: CCN
Type: Apache Web site
Apache Ant

Source: security@apache.org
Type: Patch, Vendor Advisory
security@apache.org

Source: XF
Type: UNKNOWN
apache-cve202136374-dos(205314)

Source: security@apache.org
Type: Mailing List, Vendor Advisory
security@apache.org

Source: security@apache.org
Type: Mailing List, Vendor Advisory
security@apache.org

Source: security@apache.org
Type: Mailing List, Vendor Advisory
security@apache.org

Source: security@apache.org
Type: Mailing List, Vendor Advisory
security@apache.org

Source: security@apache.org
Type: Mailing List, Vendor Advisory
security@apache.org

Source: CCN
Type: oss-sec Mailing List, Tue, 13 Jul 2021 17:15:51 +0000
CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability

Source: security@apache.org
Type: Third Party Advisory
security@apache.org

Source: CCN
Type: IBM Security Bulletin 6514441 (Tivoli Netcool/Impact)
IBM Tivoli Netcool Impact is affected by an Apache Ant vulnerability (CVE-2021-36374)

Source: CCN
Type: IBM Security Bulletin 6518994 (Installation Manager)
Vulnerabilities in Apache Ant affect IBM Installation Manager and IBM Packaging Utility

Source: CCN
Type: IBM Security Bulletin 6570957 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6619111 (Intelligent Operations Center)
A vulnerability foud in IBM Installation Manager which is shipped with IBM Intelligent Operations Center(CVE-2021-36374)

Source: CCN
Type: IBM Security Bulletin 6825111 (Content Collector)
Multiple Vulnerabilities may affect Apache Ant used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Source: CCN
Type: IBM Security Bulletin 6829339 (InfoSphere Information Server)
Multiple vulnerabilities in Apache Ant affect IBM InfoSphere Information Server

Source: CCN
Type: Oracle CPUApr2022
Oracle Critical Patch Update Advisory - April 2022

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Oracle CPUJan2022
Oracle Critical Patch Update Advisory - January 2022

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Oracle CPUJul2022
Oracle Critical Patch Update Advisory - July 2022

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Oracle CPUOct2021
Oracle Critical Patch Update Advisory - October 2021

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:ibm:tivoli_netcool/impact:7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:content_collector:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:agile_plm_framework:9.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_store_inventory_management:15.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_store_inventory_management:16.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:utilities_framework:4.3.0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:primavera_unifier:17.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:intelligent_operations_center:5.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:intelligent_operations_center:5.1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:intelligent_operations_center:5.1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:intelligent_operations_center:5.1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:intelligent_operations_center:5.1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:intelligent_operations_center:5.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:intelligent_operations_center:5.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7986
    P
    		ant-1.10.12-150200.4.12.5 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:3363
    P
    		screen-4.0.4-23.3.3 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94993
    P
    		ant-1.10.7-150200.4.6.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:119075
    P
    		Security update for ant (Moderate)
    2022-04-27
    oval:org.opensuse.security:def:450
    P
    		Security update for ant (Moderate)
    2022-04-27
    oval:org.opensuse.security:def:101840
    P
    		Security update for ant (Moderate)
    2022-04-27
    oval:org.opensuse.security:def:5225
    P
    		Security update for ant (Moderate)
    2022-04-27
    oval:org.opensuse.security:def:1162
    P
    		Security update for ant (Moderate)
    2022-04-27
    oval:org.opensuse.security:def:6019
    P
    		Security update for ant (Moderate)
    2022-04-27
    oval:org.opensuse.security:def:111933
    P
    		ant-1.10.12-1.1 on GA media (Moderate)
    2022-01-17
    BACK
    ibm tivoli netcool/impact 7.1.0
    ibm content collector 4.0.1
    oracle retail point-of-service 14.0
    oracle retail point-of-service 14.1
    oracle retail back office 14.0
    oracle retail back office 14.1
    oracle agile plm framework 9.3.6
    oracle retail advanced inventory planning 14.1
    oracle retail advanced inventory planning 15.0
    oracle retail predictive application server 14.1.3
    oracle retail store inventory management 14.1
    oracle retail store inventory management 15.0
    oracle retail store inventory management 16.0
    oracle utilities framework 4.2.0.2.0
    oracle utilities framework 4.2.0.3.0
    oracle utilities framework 4.3.0.3.0
    oracle enterprise repository 11.1.1.7.0
    ibm infosphere information server 11.7
    oracle primavera unifier 17.12
    oracle retail predictive application server 15.0.3
    oracle retail central office 14.0
    oracle retail central office 14.1
    oracle primavera unifier 18.8
    ibm intelligent operations center 5.1.0
    ibm intelligent operations center 5.1.0.2
    ibm intelligent operations center 5.1.0.3
    ibm intelligent operations center 5.1.0.4
    ibm intelligent operations center 5.1.0.6
    oracle communications unified inventory management 7.4.0
    ibm intelligent operations center 5.2
    ibm intelligent operations center 5.2.1
    ibm cognos analytics 11.2.0
    ibm cognos analytics 11.1.7
    ibm cognos analytics 11.2.1