Design/Logic Flaw

2021-07-1407:15:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

42.3%

JSON

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

CPENameOperatorVersion
antge1.10.0
antlt1.10.11
antge1.9.0
antlt1.9.16
agile_plmeq9.3.6
banking_trade_financeeq14.5
banking_treasury_managementeq14.5
communications_cloud_native_core_automated_test_suiteeq1.9.0
communications_cloud_native_core_binding_support_functioneq1.11.0
communications_order_and_service_managementeq7.4

Name	Operator	Version
ant	ge	1.10.0
ant	lt	1.10.11
ant	ge	1.9.0
ant	lt	1.9.16
agile_plm	eq	9.3.6
banking_trade_finance	eq	14.5
banking_treasury_management	eq	14.5
communications_cloud_native_core_automated_test_suite	eq	1.9.0
communications_cloud_native_core_binding_support_function	eq	1.11.0
communications_order_and_service_management	eq	7.4