Opened 3 months ago

Closed 3 months ago

Last modified 3 months ago

#15277 closed enhancement (fixed)

apache-ant-1.10.11

Reported by: Douglas R. Reno Owned by: thomas
Priority: elevated Milestone: 11.0
Component: BOOK Version: git
Severity: normal Keywords:
Cc:

Description

New point version. This is a security release.

Change History (5)

comment:1 by Douglas R. Reno, 3 months ago

CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability


Description:

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant.


Mitigation:

Apache Ant 1.9.x users should upgrade to 1.9.16 or later.
Apache Ant 1.10.x users should upgrade to 1.10.11 or later.

Credit:

This issue is similar to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35517 present in Apache Commons Compress which has been detected by OSS Fuzz.

References:

https://ant.apache.org/security.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35517

comment:2 by Douglas R. Reno, 3 months ago

CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulnerability


Description:

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant.

Commonly used derived formats from ZIP archives are for instance JAR files and many office files.

Mitigation:

Apache Ant 1.9.x users should upgrade to 1.9.16 or later.
Apache Ant 1.10.x users should upgrade to 1.10.11 or later.

Credit:

This issue is similar to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36090 present in Apache Commons Compress which has been detected by OSS Fuzz.

References:

https://ant.apache.org/security.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36090

comment:3 by thomas, 3 months ago

Owner: changed from blfs-book to thomas
Status: newassigned

Changes from Ant 1.10.10 TO Ant 1.10.11

Fixed bugs:

  • a race condition could lead to NullPointerExceptions when running tasks in parallel. Bugzilla Report 65316
  • fixed potential OutOfMemory errors when reading broken archives using the tar or zip formats or formats derived from zip.

Other changes:

  • org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now has a new protected createExecuteWatchdog() method for allowing it to be overriden. Github Pull Request #147
  • Upgraded AntUnit to 1.4.1.

comment:4 by thomas, 3 months ago

Resolution: fixed
Status: assignedclosed

Fixed in [62f5a3de]

comment:5 by Bruce Dubbs, 3 months ago

Milestone: 10.211.0

Milestone renamed

Note: See TracTickets for help on using tickets.