QwikSec

Security Database

CVE

CWE

Training

CVE-2020-1945

Published: May 14, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Vendor	Product	Versions
n/a	Apache Ant	affected `Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7`

References

[creadur-dev] 20200518 [jira] [Created] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[creadur-commits] 20200518 [creadur-rat] 03/03: RAT-269: Update Apache ANT to fix CVE-2020-1945

mailing-list

x_refsource_MLIST

[creadur-commits] 20200518 [creadur-rat] branch master updated: RAT-269: Update Apache ANT to fix CVE-2020-1945

mailing-list

x_refsource_MLIST

[creadur-dev] 20200518 [jira] [Closed] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[creadur-dev] 20200518 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[creadur-dev] 20200518 [jira] [Assigned] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[groovy-notifications] 20200522 [jira] [Closed] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[hive-dev] 20200530 [jira] [Created] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[hive-issues] 20200530 [jira] [Assigned] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[hive-issues] 20200530 [jira] [Updated] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[hive-issues] 20200530 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_UBUNTU

FEDORA-2020-52741b0a49

vendor-advisory

x_refsource_FEDORA

FEDORA-2020-7f07da3fef

vendor-advisory

x_refsource_FEDORA

[hive-issues] 20200621 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[creadur-dev] 20200703 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

https://www.oracle.com/security-alerts/cpujul2020.html

x_refsource_MISC

https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E

x_refsource_MISC

[db-torque-dev] 20200715 svn commit: r1879896 - in /db/torque/torque4/trunk: ./ torque-ant-tasks/ torque-ant-tasks/src/test/java/org/apache/torque/ant/task/ torque-generator/src/main/java/org/apache/torque/generator/control/ torque-generator/src/main/java/org/apache/torque/gen...

mailing-list

x_refsource_MLIST

openSUSE-SU-2020:1022

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_GENTOO

[hive-issues] 20200804 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[myfaces-commits] 20200826 [myfaces-tobago] branch tobago-2.x updated: update ant because of CVE-2020-1945

mailing-list

x_refsource_MLIST

[ant-dev] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[announce] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[ant-user] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[creadur-dev] 20200930 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[creadur-dev] 20200930 [jira] [Created] (RAT-274) Update to latest Ant in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[oss-security] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

[creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

https://www.oracle.com/security-alerts/cpuoct2020.html

x_refsource_MISC

[hive-issues] 20201022 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT

mailing-list

x_refsource_MLIST

[groovy-notifications] 20201126 [jira] [Updated] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[groovy-notifications] 20201126 [jira] [Comment Edited] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[groovy-commits] 20201126 [groovy] branch GROOVY_2_4_X updated: GROOVY-9552: Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability

mailing-list

x_refsource_MLIST

[groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure

mailing-list

x_refsource_MLIST

[groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure

mailing-list

x_refsource_MLIST

[oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosure

mailing-list

x_refsource_MLIST

[announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure

mailing-list

x_refsource_MLIST

[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure

mailing-list

x_refsource_MLIST

[myfaces-commits] 20201211 [myfaces-tobago] 02/22: update ant because of CVE-2020-1945

mailing-list

x_refsource_MLIST

https://www.oracle.com/security-alerts/cpujan2021.html

x_refsource_MISC

[creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

https://www.oracle.com/security-alerts/cpuApr2021.html

x_refsource_MISC

[creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8

mailing-list

x_refsource_MLIST

https://www.oracle.com//security-alerts/cpujul2021.html

x_refsource_MISC

https://www.oracle.com/security-alerts/cpuoct2021.html

x_refsource_MISC

https://www.oracle.com/security-alerts/cpujan2022.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.