CVE-2021-36373 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 07/14/2021
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/27/2025
The vulnerability identified as CVE-2021-36373 represents a memory exhaustion flaw within Apache Ant build tool that manifests when processing maliciously crafted tar archives. This issue stems from insufficient input validation and memory allocation controls during the extraction process of tar files, allowing attackers to exploit the system's resource management mechanisms. The flaw specifically affects versions prior to 1.9.16 and 1.10.11 of Apache Ant, making a significant portion of the user base susceptible to this denial of service attack vector. The vulnerability operates by manipulating the archive structure to cause the build system to allocate excessive memory resources, ultimately leading to out of memory conditions that disrupt legitimate build operations.
The technical implementation of this vulnerability leverages the tar archive extraction mechanism within Apache Ant to create artificial memory pressure through carefully constructed archive metadata. When the build system encounters such malformed archive entries, it fails to properly limit memory allocation based on actual file sizes, instead allowing the system to consume resources proportional to the manipulated archive structure rather than the actual data content. This behavior creates a condition where even small input files can trigger massive memory consumption, effectively transforming a simple file operation into a resource exhaustion attack. The flaw demonstrates poor adherence to secure coding practices regarding resource management and input validation, which aligns with CWE-400, which addresses unchecked resource consumption vulnerabilities.
From an operational perspective, this vulnerability presents a significant disruption risk to continuous integration and deployment pipelines that rely on Apache Ant for build automation. Attackers can exploit this weakness to cause build failures, system instability, and potential service degradation across development environments. The impact extends beyond simple denial of service as it can affect the entire build infrastructure, potentially causing cascading failures in automated deployment systems. Organizations using Apache Ant in production environments face the risk of unauthorized parties disrupting their build processes, leading to delays in software releases and potential security implications. This vulnerability particularly affects CI/CD systems where automated builds are executed without proper input sanitization, creating an attack surface that can be exploited to cause operational disruptions.
Mitigation strategies for CVE-2021-36373 primarily involve upgrading to Apache Ant versions 1.9.16 or 1.10.11, which contain fixes that properly validate archive metadata and implement appropriate memory allocation limits. System administrators should also implement input validation controls at the network level to filter potentially malicious tar archives before they reach the build systems. Additional protective measures include implementing resource limits and monitoring for unusual memory consumption patterns during build processes, which can help detect exploitation attempts. Organizations should also consider implementing sandboxing mechanisms for build environments to contain the impact of such attacks and establish automated alerting systems that trigger when memory usage exceeds normal operational thresholds. The vulnerability's classification under ATT&CK technique T1499.004 for network denial of service emphasizes the importance of implementing robust resource management controls to prevent exploitation.