What is the CVSS score of CVE-2021-36373?

CVE-2021-36373 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 2.5%.

Is there a patch available for CVE-2021-36373?

Yes, a patch is available for CVE-2021-36373. Update the affected software to the latest version immediately.

Utilities Framework CVE-2021-36373

MEDIUM

Improper Handling of Length Parameter Inconsistency (CWE-130)

2021-07-14 security@apache.org

Apache Information Disclosure Oracle Utilities Framework Communications Order And Service Management Financial Services Analytical Applications Infrastructure Retail Back Office Communications Cloud Native Core Binding Support Function Agile Plm Retail Advanced Inventory Planning Retail Central Office Retail Eftlink Retail Invoice Matching Retail Point Of Service Retail Store Inventory Management Retail Xstore Point Of Service Timesten In Memory Database Primavera Unifier Retail Merchandising System Retail Service Backbone Banking Treasury Management Communications Unified Inventory Management Insurance Policy Administration Primavera Gateway Retail Integration Bus Retail Extract Transform And Load Retail Predictive Application Server Enterprise Repository Utilities Testing Accelerator Retail Bulk Data Integration Communications Cloud Native Core Automated Test Suite Retail Financial Integration Real Time Decision Server Ant Banking Trade Finance

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Jul 14, 2021 - 07:15 nvd

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

31 maven packages depend on org.apache.ant:ant (25 direct, 6 indirect)

Ecosystem-wide dependent count for version 1.10.0.

DescriptionNVD

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

AnalysisAI

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-130. When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected. Affected products include: Apache Ant, Oracle Agile Plm, Oracle Banking Trade Finance, Oracle Banking Treasury Management, Oracle Communications Cloud Native Core Automated Test Suite. Version information: prior to 1.9.16.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.