Apache Ant TAR archive denial of service vulnerability
Priority LOW 30CWE-130Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 12 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Why it matters now
EPSS 0.02532 85th percentileScored 2026-11-07
Fix Partial Apache Ant (Apache Software Foundation): Apache Antorg.apache.ant:ant (Maven): 1.9.16, 1.10.11Red Hat: 1 advisoryRed Hat: 1 fixed, 12 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Ant | Apache Ant 1.9.x – 1.9.15; Apache Ant 1.10.x – 1.10.10 | Apache Ant | Patch available | CNA |
| — | org.apache.ant:ant (Maven) | before 1.9.16 | 1.9.16 | Patch available | GHSA-q5r4-cfpx-h6fh |
| — | org.apache.ant:ant (Maven) | 1.10.0 to before 1.10.11 | 1.10.11 | Patch available | GHSA-q5r4-cfpx-h6fh |
- Apache Ant VendorApache Affected Apache Ant 1.9.x – 1.9.15; Apache Ant 1.10.x – 1.10.10 Fixed in Apache Ant Patch available CNA
- org.apache.ant:ant (Maven) Vendor— Affected before 1.9.16 Fixed in 1.9.16 Patch available GHSA-q5r4-cfpx-h6fh
- org.apache.ant:ant (Maven) Vendor— Affected 1.10.0 to before 1.10.11 Fixed in 1.10.11 Patch available GHSA-q5r4-cfpx-h6fh
CPE configurations NVD · 69
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:* | 1.9.0 to before 1.9.16; 1.10.0 to before 1.10.11 | Vulnerable | Apache |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* | 9.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* | 1.11.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:* Versions 1.9.0 to before 1.9.16; 1.10.0 to before 1.10.11 Vulnerable ·Apache
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
Show 59 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* | 7.4.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:* | 7.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* | 11.1.1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* | 11.0 – 11.3.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:* | 3.2.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:* | 20.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:* | 13.2.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:* | 14.1.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:*:*:*:*:*:*:* | 15.0.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:* | 14.1.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:*:*:*:*:*:*:* | 15.0.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:*:*:*:*:*:*:* | 19.0.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:* | 16.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:* | 14.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:* | 15.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* | 14.1.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:*:*:*:*:*:*:* | 15.0.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:*:*:*:*:*:*:* | 19.0.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_store_inventory_management:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_store_inventory_management:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* | 16.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* | 17.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* | 18.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* | 20.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* | before 11.2.2.8.27 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* | 4.3.0.1.0 – 4.3.0.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* | 4.2.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* | 4.2.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* | 4.4.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* | 4.4.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* | 4.4.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* | 6.0.0.1.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* Versions 11.0 – 11.3.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:* Versions 3.2.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:* Versions 13.2.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:*:*:*:*:*:*:* Versions 15.0.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:*:*:*:*:*:*:* Versions 15.0.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:*:*:*:*:*:*:* Versions 19.0.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:*:*:*:*:*:*:* Versions 15.0.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:*:*:*:*:*:*:* Versions 19.0.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_store_inventory_management:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_store_inventory_management:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 11.2.2.8.27 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* Versions 4.3.0.1.0 – 4.3.0.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* Versions 4.2.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* Versions 4.2.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* Versions 4.4.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* Versions 6.0.0.1.1 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache Ant (Apache Software Foundation) Fixed in Apache Ant
- Fix · GHSA-q5r4-cfpx-h6fh org.apache.ant:ant (Maven) Fixed in 1.9.16 Advisory →
- Fix · GHSA-q5r4-cfpx-h6fh org.apache.ant:ant (Maven) Fixed in 1.10.11 Advisory →
Red Hat 1 advisory
- RHSA-2022:5903 Released 2022-08-04 · Red Hat rating ModerateRed Hat Process Automation Manager 7.13.0 security update
- RHPAM 7.13.0 async
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix yet: Fix deferred |
| RHPAM 7.13.0 async | Fixed | RHSA-2022:5903 |
Not affected: 4 products
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36373
- 2026-10-03 Alias added: GHSA-q5r4-cfpx-h6fh
References
Patch 4
Advisory 3
Other 10
- [groovy-commits] 20210714 [groovy] 08/09: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)
- [groovy-commits] 20210715 [groovy] 02/07: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)
- [groovy-notifications] 20210715 [jira] [Resolved] (GROOVY-10169) Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)
- [myfaces-dev] 20210830 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #1215: build: CVE fix
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a@%3Ccommits.groovy.apache.org%3E
- https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d@%3Ccommits.groovy.apache.org%3E
- https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a@%3Cnotifications.groovy.apache.org%3E
- https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6@%3Cdev.myfaces.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210819-0007
More Apache Ant vulnerabilities
- TI-2020-09639 Injection in Apache Ant CVSS 3.1HIGH 7.5
- TI-2026-54427 Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write CVSS 3.1HIGH 7.4
- TI-2020-01869 Exposure of resource to wrong sphere in Apache Ant CVSS 3.1MEDIUM 6.3
- TI-2021-14728 Apache Ant ZIP, and ZIP based, archive denial of service vulerability CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-36373 · CVE Program
- CVE-2021-36373 · NVD
- FIRST EPSS
- GHSA-q5r4-cfpx-h6fh · GitHub Advisory Database · CC BY 4.0
- CVE-2021-36373 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences