製品・ソフトウェアに関する情報

JVN脆弱性詳細

Apache Ant における脆弱性

タイトル	Apache Ant における脆弱性
概要	Apache Ant には、不特定の脆弱性が存在します。
想定される影響	サービス運用妨害 (DoS) 状態にされる可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2021年7月14日0:00
登録日	2022年6月13日16:58
最終更新日	2022年6月13日16:58

CVSS3.0 : 警告
スコア	5.5
ベクター	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS2.0 : 警告
スコア	4.3
ベクター	AV:N/AC:M/Au:N/C:N/I:N/A:P

影響を受けるシステム

Apache Software Foundation

Apache Ant 1.10.11 未満

Apache Ant 1.9.16 未満

オラクル

Oracle Agile PLM

Oracle Communications Unified Inventory Management

Oracle Enterprise Repository

Oracle Financial Services Analytical Applications Infrastructure

Oracle Insurance Policy Administration

Oracle Real-Time Decision Server

Oracle Retail Advanced Inventory Planning

Oracle Retail Back Office

Primavera Gateway

Primavera Unifier

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-36373	https://www.cve.org/CVERecord?id=CVE-2021-36373
National Vulnerability Database (NVD)
2	CVE-2021-36373	https://nvd.nist.gov/vuln/detail/CVE-2021-36373
Pony Mail
3	CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability	https://lists.apache.org/thread/wnn418gfd7dfxbzbj08ptvgwd5zjk805

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	名前	URL
Apache Software Foundation
1	Apache Ant Security Reports	https://ant.apache.org/security.html
Oracle Critical Patch Update
2	Oracle Critical Patch Update Advisory - January 2022	https://www.oracle.com/security-alerts/cpujan2022.html
3	Oracle Critical Patch Update Advisory - October 2021	https://www.oracle.com/security-alerts/cpuoct2021.html
Pony Mail
4	[GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #1215: build: CVE fix	https://lists.apache.org/thread/nbrkysvghc25tg6zqpym8nfx8c618v2y
5	[groovy] 02/07: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)	https://lists.apache.org/thread/xopmbhzt0lf7h4q1b9f5yvq7m7pvf529
6	[groovy] 08/09: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)	https://lists.apache.org/thread/fcy84z166vf6yz2799r7dp8pj6ggofxq
7	[jira] [Resolved] (GROOVY-10169) Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)	https://lists.apache.org/thread/mwhq864v9wmodjlzncf1xndc8hxrlkyc

変更履歴

No	変更内容	変更日
1	[2022年04月19日] 掲載	2022年4月19日11:46

NVD脆弱性情報

CVE-2021-36373

概要	When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
公表日	2021年7月14日16:15
登録日	2021年7月14日20:00
最終更新日	2024年11月21日15:13

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:apache:ant::::::::	1.10.0			1.10.11
cpe:2.3:a:apache:ant::::::::	1.9.0			1.9.16

構成2	以上	以下	より上	未満
cpe:2.3:a:oracle:retail_store_inventory_management:14.1:::::::*
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:::::::*
cpe:2.3:a:oracle:retail_back_office:14.1:::::::*
cpe:2.3:a:oracle:retail_back_office:14.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:::::::*
cpe:2.3:a:oracle:retail_central_office:14.0:::::::*
cpe:2.3:a:oracle:retail_central_office:14.1:::::::*
cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*
cpe:2.3:a:oracle:retail_point-of-service:14.1:::::::*
cpe:2.3:a:oracle:retail_point-of-service:14.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:::::::*
cpe:2.3:a:oracle:primavera_unifier::::::::	17.7	17.12
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:::::::*
cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:16.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*
cpe:2.3:a:oracle:utilities_framework::::::::	4.3.0.1.0	4.3.0.6.0
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:::::::*
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:20.12:::::::*
cpe:2.3:a:oracle:communications_order_and_service_management:7.4:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:::::::*
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	17.12.0	17.12.11
cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	20.12.0	20.12.7
cpe:2.3:a:oracle:primavera_gateway::::::::	19.12.0	19.12.11
cpe:2.3:a:oracle:primavera_gateway::::::::	18.8.0	18.8.12
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure::::::::	8.0.6	8.1.1
cpe:2.3:a:oracle:insurance_policy_administration::::::::	11.0	11.3.1
cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:::::::*
cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:::::::*
cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:::::::*
cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:::::::*
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:::::::*
cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:::::::*
cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:15.0:::::::*
cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:::::::*
cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:::::::*
cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:::::::*
cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:::::::*
cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:::::::*
cpe:2.3:a:oracle:retail_eftlink:19.0.1:::::::*
cpe:2.3:a:oracle:communications_order_and_service_management:7.3:::::::*
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:::::::*
cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:::::::*
cpe:2.3:a:oracle:retail_eftlink:20.0.1:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:::::::*
cpe:2.3:a:oracle:timesten_in-memory_database::::::::				11.2.2.8.27
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:::::::*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance:14.5:::::::*
cpe:2.3:a:oracle:banking_treasury_management:14.5:::::::*

関連情報、対策とツール

No	URL	タグ
1	https://ant.apache.org/security.html	Patch Vendor Advisory
2	https://ant.apache.org/security.html	Patch Vendor Advisory
3	https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
4	https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
5	https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
6	https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
7	https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E	Mailing List Vendor Advisory
8	https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E	Mailing List Vendor Advisory
9	https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
10	https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
11	https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
12	https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
13	https://security.netapp.com/advisory/ntap-20210819-0007/	Third Party Advisory
14	https://security.netapp.com/advisory/ntap-20210819-0007/	Third Party Advisory
15	https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
16	https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
17	https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
18	https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
19	https://www.oracle.com/security-alerts/cpujul2022.html	Not Applicable
20	https://www.oracle.com/security-alerts/cpujul2022.html	Not Applicable
21	https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory
22	https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory

共通脆弱性一覧

構成2	以上	以下	より上	未満
cpe:2.3:a:oracle:retail_store_inventory_management:14.1:::::::*
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:::::::*
cpe:2.3:a:oracle:retail_back_office:14.1:::::::*
cpe:2.3:a:oracle:retail_back_office:14.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:::::::*
cpe:2.3:a:oracle:retail_central_office:14.0:::::::*
cpe:2.3:a:oracle:retail_central_office:14.1:::::::*
cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*
cpe:2.3:a:oracle:retail_point-of-service:14.1:::::::*
cpe:2.3:a:oracle:retail_point-of-service:14.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:::::::*
cpe:2.3:a:oracle:primavera_unifier::::::::	17.7	17.12
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:::::::*
cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:16.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*
cpe:2.3:a:oracle:utilities_framework::::::::	4.3.0.1.0	4.3.0.6.0
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:::::::*
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:20.12:::::::*
cpe:2.3:a:oracle:communications_order_and_service_management:7.4:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:::::::*
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	17.12.0	17.12.11
cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	20.12.0	20.12.7
cpe:2.3:a:oracle:primavera_gateway::::::::	19.12.0	19.12.11
cpe:2.3:a:oracle:primavera_gateway::::::::	18.8.0	18.8.12
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure::::::::	8.0.6	8.1.1
cpe:2.3:a:oracle:insurance_policy_administration::::::::	11.0	11.3.1
cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:::::::*
cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:::::::*
cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:::::::*
cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:::::::*
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:::::::*
cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:::::::*
cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:15.0:::::::*
cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:::::::*
cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:::::::*
cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:::::::*
cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:::::::*
cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:::::::*
cpe:2.3:a:oracle:retail_eftlink:19.0.1:::::::*
cpe:2.3:a:oracle:communications_order_and_service_management:7.3:::::::*
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:::::::*
cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:::::::*
cpe:2.3:a:oracle:retail_eftlink:20.0.1:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:::::::*
cpe:2.3:a:oracle:timesten_in-memory_database::::::::				11.2.2.8.27
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:::::::*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance:14.5:::::::*
cpe:2.3:a:oracle:banking_treasury_management:14.5:::::::*