Security update for ant SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1417-1 Final 1 1 2022-04-27T07:19:20Z current 2022-04-27T07:19:20Z 2022-04-27T07:19:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ant This update for ant fixes the following issues: - CVE-2021-36373: Fixed an excessive memory allocation when reading a specially crafted TAR archive (bsc#1188468). - CVE-2021-36374: Fixed an excessive memory allocation when reading a specially crafted ZIP archive (bsc#1188469). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1417,SUSE-SLE-SDK-12-SP5-2022-1417,SUSE-SLE-SERVER-12-SP5-2022-1417 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221417-1/ Link for SUSE-SU-2022:1417-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010842.html E-Mail link for SUSE-SU-2022:1417-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188468 SUSE Bug 1188468 https://bugzilla.suse.com/1188469 SUSE Bug 1188469 https://www.suse.com/security/cve/CVE-2021-36373/ SUSE CVE CVE-2021-36373 page https://www.suse.com/security/cve/CVE-2021-36374/ SUSE CVE CVE-2021-36374 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 ant-1.9.4-3.9.1 ant-antlr-1.9.4-3.9.1 ant-apache-bcel-1.9.4-3.9.1 ant-apache-bsf-1.9.4-3.9.1 ant-apache-log4j-1.9.4-3.9.1 ant-apache-oro-1.9.4-3.9.1 ant-apache-regexp-1.9.4-3.9.1 ant-apache-resolver-1.9.4-3.9.1 ant-apache-xalan2-1.9.4-3.9.1 ant-commons-logging-1.9.4-3.9.1 ant-commons-net-1.9.4-3.9.1 ant-javadoc-1.9.4-3.9.1 ant-javamail-1.9.4-3.9.1 ant-jdepend-1.9.4-3.9.1 ant-jmf-1.9.4-3.9.1 ant-jsch-1.9.4-3.9.1 ant-junit-1.9.4-3.9.1 ant-manual-1.9.4-3.9.1 ant-scripts-1.9.4-3.9.1 ant-swing-1.9.4-3.9.1 ant-testutil-1.9.4-3.9.1 ant-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Server 12 SP5 ant-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ant-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-antlr-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-apache-bcel-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-apache-bsf-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-apache-log4j-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-apache-oro-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-apache-regexp-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-apache-resolver-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-commons-logging-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-javadoc-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-javamail-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-jdepend-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-jmf-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-junit-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-manual-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-scripts-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ant-swing-1.9.4-3.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected. CVE-2021-36373 SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221417-1/ https://www.suse.com/security/cve/CVE-2021-36373.html CVE-2021-36373 https://bugzilla.suse.com/1188468 SUSE Bug 1188468 When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. CVE-2021-36374 SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.9.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221417-1/ https://www.suse.com/security/cve/CVE-2021-36374.html CVE-2021-36374 https://bugzilla.suse.com/1188469 SUSE Bug 1188469