QwikSec

Security Database

CVE

CWE

Training

CVE-2020-11979

Published: Oct 1, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Vendor	Product	Versions
n/a	Apache Ant	affected `Apache Ant 1.10.8`

Weaknesses (CWE)

References

https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E

x_refsource_MISC

[creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

FEDORA-2020-2640aa4e19

vendor-advisory

x_refsource_FEDORA

FEDORA-2020-92b1d001b3

vendor-advisory

x_refsource_FEDORA

FEDORA-2020-3ce0f55bc5

vendor-advisory

x_refsource_FEDORA

vendor-advisory

x_refsource_GENTOO

https://www.oracle.com/security-alerts/cpujan2021.html

x_refsource_MISC

https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm

x_refsource_MISC

[creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

https://www.oracle.com/security-alerts/cpuApr2021.html

x_refsource_MISC

[creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

https://www.oracle.com//security-alerts/cpujul2021.html

x_refsource_MISC

https://www.oracle.com/security-alerts/cpuoct2021.html

x_refsource_MISC

https://www.oracle.com/security-alerts/cpujan2022.html

x_refsource_MISC

https://www.oracle.com/security-alerts/cpuapr2022.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.