apache-ant-1.10.11

[Douglas R. Reno]

New point version. This is a security release.

[Douglas R. Reno]

CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability

Description:

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant.


Mitigation:

Apache Ant 1.9.x users should upgrade to 1.9.16 or later.
Apache Ant 1.10.x users should upgrade to 1.10.11 or later.

Credit:

This issue is similar to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35517 present in Apache Commons Compress which has been detected by OSS Fuzz.

References:

https://ant.apache.org/security.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35517

[Douglas R. Reno]

CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulnerability

Description:

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant.

Commonly used derived formats from ZIP archives are for instance JAR files and many office files.

Mitigation:

Apache Ant 1.9.x users should upgrade to 1.9.16 or later.
Apache Ant 1.10.x users should upgrade to 1.10.11 or later.

Credit:

This issue is similar to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36090 present in Apache Commons Compress which has been detected by OSS Fuzz.

References:

https://ant.apache.org/security.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36090

[thomas]

Changes from Ant 1.10.10 TO Ant 1.10.11

Fixed bugs:

• a race condition could lead to NullPointerExceptions when running tasks in parallel. Bugzilla Report 65316

• fixed potential OutOfMemory errors when reading broken archives using the tar or zip formats or formats derived from zip.

Other changes:

• org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now has a new protected createExecuteWatchdog() method for allowing it to be overriden. Github Pull Request #147

• Upgraded AntUnit to 1.4.1.

[thomas]

Fixed in [62f5a3de]

[Bruce Dubbs]

Milestone renamed