ant:ant@1.6.2 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the ant:ant package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • L
Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted ZIP archive, or a derived format, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats of ZIP archives include JAR files.

How to fix Denial of Service (DoS)?

Upgrade ant:ant to version 1.10.11, 1.9.16 or higher.

[1.10.0,1.10.11) (,1.9.16)
  • L
Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs.

How to fix Denial of Service (DoS)?

Upgrade ant:ant to version 1.10.11, 1.9.16 or higher.

[1.10.0,1.10.11) (,1.9.16)
  • M
Insecure Default

Affected versions of this package are vulnerable to Insecure Default. It uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

How to fix Insecure Default?

There is no fixed version for ant:ant.

[0,)