CVE-2020-11979
published 2020-10-01CVE-2020-11979: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
8.24%
94.3th percentile
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Affected
77 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ant | — | — |
| apache | ant | >= 0 < 1.10.9-1 | 1.10.9-1 |
| apache | ant | >= 0 < 1.10.9-1 | 1.10.9-1 |
| apache | ant | >= 0 < 1.10.9-1 | 1.10.9-1 |
| apache | ant | >= 0 < 1.10.9-1 | 1.10.9-1 |
| debian | ant | < ant 1.10.9-1 (bookworm) | ant 1.10.9-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| gradle | gradle | < 6.8.0 | 6.8.0 |
| msrc | cm1_ant_1.10.11-1_on_cbl_mariner_1.0 | — | — |
| oracle | agile_engineering_data_management | — | — |
| oracle | api_gateway | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_treasury_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | data_integrator | — | — |
| oracle | data_integrator | — | — |
| oracle | endeca_information_discovery_studio | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
ghsa6.3MEDIUM
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Code injection in Apache Ant
ghsa·2021-02-03·CVSS 6.3
CVE-2020-11979 [MEDIUM] CWE-74 Code injection in Apache Ant
Code injection in Apache Ant
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
OSV
Code injection in Apache Ant
osv·2021-02-03·CVSS 6.3
CVE-2020-11979 [MEDIUM] Code injection in Apache Ant
Code injection in Apache Ant
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
OSV
CVE-2020-11979: As mitigation for CVE-2020-1945 Apache Ant 1
osv·2020-10-01·CVSS 7.5
CVE-2020-11979 [HIGH] CVE-2020-11979: As mitigation for CVE-2020-1945 Apache Ant 1
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Oracle
Oracle Oracle Utilities Applications Risk Matrix: Installation (Apache Ant) — CVE-2020-11979
vendor_oracle·2023-01-15·CVSS 7.5
CVE-2020-11979 [HIGH] Oracle Oracle Utilities Applications Risk Matrix: Installation (Apache Ant) — CVE-2020-11979
Oracle Oracle Utilities Applications Risk Matrix: Installation (Apache Ant) vulnerability
CVE: CVE-2020-11979
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Oracle
Oracle Oracle Systems Risk Matrix: Software (Apache Ant) — CVE-2020-11979
vendor_oracle·2022-04-15·CVSS 7.5
CVE-2020-11979 [HIGH] Oracle Oracle Systems Risk Matrix: Software (Apache Ant) — CVE-2020-11979
Oracle Oracle Systems Risk Matrix: Software (Apache Ant) vulnerability
CVE: CVE-2020-11979
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle TimesTen In-Memory Database Risk Matrix: Install (Apache Ant) — CVE-2020-11979
vendor_oracle·2022-01-15·CVSS 6.5
CVE-2020-11979 [HIGH] Oracle Oracle TimesTen In-Memory Database Risk Matrix: Install (Apache Ant) — CVE-2020-11979
Oracle Oracle TimesTen In-Memory Database Risk Matrix: Install (Apache Ant) vulnerability
CVE: CVE-2020-11979
CVSS: 6.5
Protocol: Local Logon
Remote exploit: No
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Capital Workflow (Apache Ant) — CVE-2020-11979
vendor_oracle·2021-07-15·CVSS 7.5
CVE-2020-11979 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Capital Workflow (Apache Ant) — CVE-2020-11979
Oracle Oracle Financial Services Applications Risk Matrix: Capital Workflow (Apache Ant) vulnerability
CVE: CVE-2020-11979
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security Component (Apache Ant) — CVE-2020-11979
vendor_oracle·2021-04-15·CVSS 7.5
CVE-2020-11979 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Security Component (Apache Ant) — CVE-2020-11979
Oracle Oracle Communications Applications Risk Matrix: Security Component (Apache Ant) vulnerability
CVE: CVE-2020-11979
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Admin (Apache Ant) — CVE-2020-11979
vendor_oracle·2021-01-15·CVSS 7.5
CVE-2020-11979 [HIGH] Oracle Oracle Construction and Engineering Risk Matrix: Admin (Apache Ant) — CVE-2020-11979
Oracle Oracle Construction and Engineering Risk Matrix: Admin (Apache Ant) vulnerability
CVE: CVE-2020-11979
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Microsoft
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted
vendor_msrc·2020-10-13·CVSS 7.5
CVE-2020-11979 [HIGH] CWE-379 As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to t
Red Hat
ant: insecure temporary file
vendor_redhat·2020-10-01·CVSS 7.5
CVE-2020-11979 [HIGH] CWE-377 ant: insecure temporary file
ant: insecure temporary file
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Statement: ant as shipped in Red Hat Enterprise Linux 8 is not affected by this flaw because this flaw is caused by the patch for CVE-2020-1945, however, it was never applied to ant as shipped in Red Hat Enterprise Linux 8, because the decision was made by Engineering to WONTFIX that flaw.
In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that compris
Debian
CVE-2020-11979: ant - As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of tem...
vendor_debian·2020·CVSS 7.5
CVE-2020-11979 [HIGH] CVE-2020-11979: ant - As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of tem...
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Scope: local
bookworm: resolved (fixed in 1.10.9-1)
bullseye: resolved (fixed in 1.10.9-1)
forky: resolved (fixed in 1.10.9-1)
sid: resolved (fixed in 1.10.9-1)
trixie: resolved (fixed in 1.10.9-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vmhttps://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/https://security.gentoo.org/glsa/202011-18https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vmhttps://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3Ehttps://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/https://security.gentoo.org/glsa/202011-18https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2020-10-01
Published