Found in HEAD Commit and Base Branch

Oct 13, 2025 by talynt.org 127 views

CVE-2021-36373 (Medium) Detected in ant-1.6.5.jar: A Critical Vulnerability in Apache Ant

The Apache Software Foundation provides support for the Apache community of open-source software projects. The Apache projects are characterized by a collaborative, consensus-based development process, an open and pragmatic software license, and a desire to create high-quality software that leads the way in its field. In this article, we will discuss a critical vulnerability detected in the ant-1.6.5.jar library, which is a part of the Apache Ant project.

The CVE-2021-36373 vulnerability is a medium severity vulnerability that affects Apache Ant prior to 1.9.16 and 1.10.11. This vulnerability occurs when reading a specially crafted TAR archive, which can lead to an out-of-memory error, even for small inputs. This can be used to disrupt builds using Apache Ant.

Vulnerable Library: ant-1.6.5.jar

The vulnerable library is ant-1.6.5.jar, which is a part of the Apache Ant project. The library home page is http://www.apache.org/ant/. The path to the dependency file is /WebGoat8/pom.xml, and the path to the vulnerable library is also /WebGoat8/pom.xml.

Dependency Hierarchy

The dependency hierarchy for the vulnerable library is as follows:

:x: ant-1.6.5.jar (Vulnerable Library)

Found in HEAD Commit and Base Branch

The vulnerable library was found in the HEAD commit with the commit hash d4d89f7f422c47fd2de38fffb10ef83b43a0bcca. It was also found in the base branch main.

Vulnerability Details

When reading a specially crafted TAR archive, an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out-of-memory error, even for small inputs. This can be used to disrupt builds using Apache Ant.

Publish Date and URL

The publish date for the CVE-2021-36373 vulnerability is 2021-07-14, and the URL for the vulnerability is https://www.mend.io/vulnerability-database/CVE-2021-36373.

CVSS 3 Score Details

The CVSS 3 score for the CVE-2021-36373 vulnerability is 5.5. The base score metrics are as follows:

Exploitability Metrics:

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged

Impact Metrics:

Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

Suggested Fix

The suggested fix for the CVE-2021-36373 vulnerability is to upgrade the version of the ant library to 1.9.16 or 1.10.11. The fix resolution is org.apache.ant:ant:1.9.16,1.10.11.

In conclusion, the CVE-2021-36373 vulnerability is a critical vulnerability that affects Apache Ant prior to 1.9.16 and 1.10.11. This vulnerability can lead to an out-of-memory error, even for small inputs, and can be used to disrupt builds using Apache Ant. It is essential to upgrade the version of the ant library to 1.9.16 or 1.10.11 to fix this vulnerability.

Upgrade the version of the ant library to 1.9.16 or 1.10.11 to fix the CVE-2021-36373 vulnerability.
Regularly update and patch the Apache Ant project to ensure that the latest security patches are applied.
Use a vulnerability scanner to detect and report vulnerabilities in the Apache Ant project.
Implement a secure coding practice to prevent similar vulnerabilities in the future.

Apache Software Foundation. (n.d.). Apache Ant. Retrieved from http://www.apache.org/ant/
Mend.io. (2021, July 14). CVE-2021-36373. Retrieved from https://www.mend.io/vulnerability-database/CVE-2021-36373
First.org. (n.d.). CVSS Calculator. Retrieved from https://www.first.org/cvss/calculator/3.0
CVE-2021-36373 (Medium) Detected in ant-1.6.5.jar: A Critical Vulnerability in Apache Ant - Q&A

In our previous article, we discussed the CVE-2021-36373 vulnerability detected in the ant-1.6.5.jar library, which is a part of the Apache Ant project. This vulnerability can lead to an out-of-memory error, even for small inputs, and can be used to disrupt builds using Apache Ant. In this article, we will answer some frequently asked questions about the CVE-2021-36373 vulnerability.

Q: What is the CVE-2021-36373 vulnerability?

A: The CVE-2021-36373 vulnerability is a medium severity vulnerability that affects Apache Ant prior to 1.9.16 and 1.10.11. This vulnerability occurs when reading a specially crafted TAR archive, which can lead to an out-of-memory error, even for small inputs.

Q: What is the impact of the CVE-2021-36373 vulnerability?

A: The impact of the CVE-2021-36373 vulnerability is that it can lead to an out-of-memory error, even for small inputs, and can be used to disrupt builds using Apache Ant. This can cause significant downtime and data loss for organizations that rely on Apache Ant for their build processes.

Q: How can I detect the CVE-2021-36373 vulnerability in my system?

A: You can detect the CVE-2021-36373 vulnerability in your system by using a vulnerability scanner. A vulnerability scanner can scan your system for known vulnerabilities, including the CVE-2021-36373 vulnerability.

Q: How can I fix the CVE-2021-36373 vulnerability in my system?

A: You can fix the CVE-2021-36373 vulnerability in your system by upgrading the version of the ant library to 1.9.16 or 1.10.11. This will ensure that your system is protected against the CVE-2021-36373 vulnerability.

Q: What are the CVSS 3 score details for the CVE-2021-36373 vulnerability?

A: The CVSS 3 score for the CVE-2021-36373 vulnerability is 5.5. The base score metrics are as follows:

Exploitability Metrics:

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged

Impact Metrics:

Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

Q: What are the recommended fixes for the CVE-2021-36373 vulnerability?

A: The recommended fixes for the CVE-2021-36373 vulnerability are:

Upgrade the version of the ant library to 1.9.16 or 1.10.11.
Regularly update and patch the Apache Ant project to ensure that the latest security patches are applied.
Use a vulnerability scanner to detect and report vulnerabilities in the Apache Ant project.
Implement a secure coding practice to prevent similar vulnerabilities in the future.

Q: What are the references for the CVE-2021-36373 vulnerability?

A: The references for the CVE-2021-36373 vulnerability are:

Apache Software Foundation. (n.d.). Apache Ant. Retrieved from http://www.apache.org/ant/
Mend.io. (2021, July 14). CVE-2021-36373. Retrieved from https://www.mend.io/vulnerability-database/CVE-2021-36373
First.org. (n.d.). CVSS Calculator. Retrieved from https://www.first.org/cvss/calculator/3.0