Arch Linux Security Advisory ASA-202107-43 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36373 CVE-2021-36374 Package : ant Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-2151 Summary ======= The package ant before version 1.10.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.11-1. # pacman -Syu "ant>=1.10.11-1" The problems have been fixed upstream in version 1.10.11. Workaround ========== None. Description =========== - CVE-2021-36373 (denial of service) When reading a specially crafted TAR archive, Apache Ant before version 1.10.11 can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. - CVE-2021-36374 (denial of service) When reading a specially crafted ZIP archive, or a derived format, Apache Ant before version 1.10.11 can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Impact ====== A crafted TAR or ZIP archive could consume large amounts of memory, leading to denial of service. References ========== https://www.openwall.com/lists/oss-security/2021/07/13/5 https://github.com/apache/ant/commit/6594a2d66f7f060dafcbbf094dd60676db19a84... https://www.openwall.com/lists/oss-security/2021/07/13/6 https://security.archlinux.org/CVE-2021-36373 https://security.archlinux.org/CVE-2021-36374