Cyber Resilience

CVE-2021-36374

Medium

Published: 14 July 2021

Published
14 July 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0014 33.9th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-36374 is a medium-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Oracle Utilities Framework. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 33.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used…

more

to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

CWE(s)
CWE-130NVD-CWE-Other

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
ant
1.9.0 — 1.9.16 · 1.10.0 — 1.10.11
oracle
agile engineering data management
6.2.1.0
oracle
agile plm
9.3.6
oracle
banking trade finance
14.5
oracle
banking treasury management
14.5
oracle
communications cloud native core automated test suite
1.9.0
oracle
communications cloud native core binding support function
1.11.0
oracle
communications diameter intelligence hub
8.0.0 — 8.1.0 · 8.2.0 — 8.2.3
oracle
communications order and service management
7.3, 7.4
oracle
communications unified inventory management
7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.5.0
+26 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References