CVE-2021-36374

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Ant is a Java based build tool. In theory it is kind of like "make" without makes wrinkles and with the full portability of pure java code.

Security Fix(es):

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.(CVE-2021-36373)

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.(CVE-2021-36374)

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

• CVE-2021-36373: resource exhaustion (OOM) when reading a crafted TAR archive's PAX extended header
• CVE-2021-36374: resource exhaustion (OOM) when reading a crafted ZIP archive
• Drop the GetTest (network) and ImageIOTest (JDK ImageIO) unit tests

TuxCare rebuilt org.apache.ant:ant to address 2 CVEs. Fixed in 1.9.4-tuxcare.2.

These are all security issues fixed in the ant-1.10.12-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ant fixes the following issues:

• CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats (bsc#1188469).
• CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection (bsc#1246873).
• CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).

Changes for ant:

• Upgrade to version 1.10.18

• Breaking changes:

• the default value for <ftp>'s useSecureDataChannel has been changed to true which means using ftps now also tries to use an encrypted data channel by default.
• the <ftp> and <scp> tasks have new allowFilesToEscapeDest attributes. When set to false - which is the default - the tasks will not download files or create directories outside the designated destination directory when downloading from the remote server. In the unlikely case you need the old bahaviour of writing outside the destination directory you must set the value to true explicitly.

• Other changes:

• when using the SOURCE_DATE_EPOCH environment variable to set the time for <tstamp> the timezone will now be set to UTC for DSTAMP, TSTAMP and TODAY. This also applies to nested formats where the locale now also defaults to en_US unless it (or the timezone) have been set explicitly.
• Upgraded the jakarta.mail dependency to 2.0.2 because of bsc#1246873, CVE-2025-7962.
• the SOURCE_DATE_EPOCH environment variable as well as the magic ant.tstamp.now and ant.tstamp.now.iso properties now also affect the timestamp added to a properties file written by <propertyfile> - but only if jdkproperties has its default value of false.
• a new method getBuildDate in Project can now be used to calculate a notion of a "build date" that consults the SOURCE_DATE_EPOCH environment variable as well as the magic ant.tstamp.now and ant.tstamp.now.iso properties in this order which you can use if you want to obtain a reproducible timestamp in tasks you write yourself.
• The "record" task now has a new "relativeToBaseDir" attribute, which can be set to "yes" or "no", to control where the recorder's file gets created. In the absence of this attribute, if the "name" of the recorder was a relative path, then the recorder would create the file in the current working directory of the process. With this new attribute, the recorder can be configured to create that file in the basedir of the project.

• Fixed bugs:

• When running with "microsoft" Java, Ant used to hardcode the "$JAVA_HOME/Packages" directory in the runtime Paths for certain tasks. The JDK shipped by Microsoft no longer contains that directory (for several decades now). As a result, when running with "microsoft" Java, an exception would be raised due to the missing directory. This has now been fixed and Ant no longer adds that directory to the Java runtime Paths.
• Inaccuracies in the documentation of the "record" task have been fixed.
• <mappedresources> with "enableMultipleMappings" set to "true" threw a NullPointerException if the mapper didn't apply to one of the resources. Unmapped resources are now omitted from the collection.

• Changes of version 1.10.17

• The JavaEnvUtils and FileUtils classes statically depend on each other since Ant 1.10.16 making it impossible to load JavaEnvUtils without loading FileUtils first causing NullPointerException for programmatic use on Windows. This affected Eclipse and may also affect other projects using Ant as a library. The classes can now be loaded independently again.

• Changes of version 1.10.16

• <xslt> now uses the same logic to compare file timestamps when determining whether a target file is out-of-date with respect to the source file or stylesheet that most other tasks use. This means it will assume a default timestamp granularity that depends on the current operating system. A new granularity attribute allows you to override the assumed granularity. …

This update for ant fixes the following issues:

• CVE-2021-36373: Fixed an excessive memory allocation when reading a specially crafted TAR archive (bsc#1188468).
• CVE-2021-36374: Fixed an excessive memory allocation when reading a specially crafted ZIP archive (bsc#1188469).

This update for ant fixes the following issues:

• CVE-2021-36373: Fixed an excessive memory allocation when reading a specially crafted TAR archive (bsc#1188468).
• CVE-2021-36374: Fixed an excessive memory allocation when reading a specially crafted ZIP archive (bsc#1188469).

This update for Java fixes the following issues:

This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting.

ant (Updated to version 1.10.18):

• Security issues fixed:

  • CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or derived formats (bsc#1188469)
  • CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873)
  • CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes (bsc#1280015)

• Other changes and bugs fixed:

  • Breaking changes:

    • FTPS tasks now use encrypted data channels by default.
    • FTP and SCP tasks now prevent files or directories from being written outside the target directory by default.

  • Other changes:

    • Added package ant-junit5 that allows tests to be launched and run using the JUnit 5 framework.
    • Improved support for reproducible builds by standardizing timestamps, file modification times, and timezone handling.
    • Upgraded the jakarta.mail dependency to version 2.0.2.
    • Added an option to the 'record' task to create log files relative to the project directory.

  • Bugs fixed:

    • Fixed compatibility and startup issues when running on newer Java versions.
    • Fixed network handling issues in FTP and SCP tasks, including proper support for IPv6 addresses.
    • Improved security in email tasks by verifying TLS server certificates and enforcing STARTTLS encryption.
    • Improved report generation performance in JUnit launcher tasks.
    • Fixed regressions and edge cases in resource mapping, path conversion, and command execution.

json-simple (Updated to version 2.3.1):

• Updated to a newer version that makes reading and writing structured web data (JSON) safer and more reliable.
• Added a 'pretty-printing' feature to format web data so it is easier to read.
• Made reading and writing data safer when multiple tasks are running simultaneously.
• Made looking up data more flexible, allowing the tool to automatically handle different format types (like numbers and text).

junit5 (Updated to version 5.14.4):

• Fixed an issue where tests could conflict or run incorrectly when executed at the same time.
• Corrected test behavior on newer versions of Java so they run reliably.
• Improved test reports so that test names are clearer, unique, and easier to distinguish from one another.
• Added features to customize how test names are generated and better capture testing outputs.

maven-doxia, maven-doxia-sitetools (Updated to version 2.1.0):

• Added support for displaying the last modification date and author on generated web pages.
• Added support for displaying interactive diagrams (such as flowcharts or charts) directly on web pages.
• Improved formatting and layout for modern documents, including better tables, lists, and links.

maven-surefire, maven-surefire-plugins (Updated to version 3.5.6):

• Fixed a bug that caused software testing tasks to fail abruptly with an unexpected error [bsc#1273185].
• Added timestamps to testing reports so you can see exactly when tests ran.
• Made running multiple tests at the same time much more reliable, preventing mixed-up report results.
• Added the ability to immediately stop testing once a failure is detected (saving time).

objectweb-asm (Updated to version 9.10.1):

• Added support for newer Java versions, including bytecode support up to Java 27.
• Prevented out-of-memory errors when processing invalid or corrupted class files.
• Improved bytecode analysis and verification to correctly handle valid Java code and prevent unexpected analysis errors
• Improved compliance with FIPS 140-3 security standards during class serialization.
• Corrected package import ranges to prevent dependency conflicts in OSGi environments.
• Fixed unexpected crashes and errors in code generation and inspection…