csaf_suse - suse-su-2022:4022-1

SUSE-SU-2022:4022-1

Vulnerability from csaf_suse - Published: 2022-11-16 15:08 - Updated: 2022-11-16 15:08

Summary

Security update for ant

Notes

Title of the patch

Security update for ant

Description of the patch

This update for ant fixes the following issues: - CVE-2020-1945: Fixed insecure temporary file vulnerability (bsc#1171696). - CVE-2020-11979: Fixed issue introduced with fix for CVE-2020-1945 (bsc#1177180).

Patchnames

SUSE-2022-4022,SUSE-SLE-SDK-12-SP5-2022-4022,SUSE-SLE-SERVER-12-SP5-2022-4022

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for ant",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for ant fixes the following issues:\n\n- CVE-2020-1945: Fixed insecure temporary file vulnerability (bsc#1171696).\n- CVE-2020-11979: Fixed issue introduced with fix for CVE-2020-1945 (bsc#1177180).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-4022,SUSE-SLE-SDK-12-SP5-2022-4022,SUSE-SLE-SERVER-12-SP5-2022-4022",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4022-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:4022-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20224022-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:4022-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012947.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1171696",
        "url": "https://bugzilla.suse.com/1171696"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177180",
        "url": "https://bugzilla.suse.com/1177180"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-11979 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-11979/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-1945 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-1945/"
      }
    ],
    "title": "Security update for ant",
    "tracking": {
      "current_release_date": "2022-11-16T15:08:09Z",
      "generator": {
        "date": "2022-11-16T15:08:09Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:4022-1",
      "initial_release_date": "2022-11-16T15:08:09Z",
      "revision_history": [
        {
          "date": "2022-11-16T15:08:09Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ant-1.9.4-3.12.1.noarch",
                "product": {
                  "name": "ant-1.9.4-3.12.1.noarch",
                  "product_id": "ant-1.9.4-3.12.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-antlr-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-antlr-1.9.4-3.12.3.noarch",
                  "product_id": "ant-antlr-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-apache-bcel-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-apache-bcel-1.9.4-3.12.3.noarch",
                  "product_id": "ant-apache-bcel-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-apache-bsf-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-apache-bsf-1.9.4-3.12.3.noarch",
                  "product_id": "ant-apache-bsf-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-apache-log4j-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-apache-log4j-1.9.4-3.12.3.noarch",
                  "product_id": "ant-apache-log4j-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-apache-oro-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-apache-oro-1.9.4-3.12.3.noarch",
                  "product_id": "ant-apache-oro-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-apache-regexp-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-apache-regexp-1.9.4-3.12.3.noarch",
                  "product_id": "ant-apache-regexp-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-apache-resolver-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-apache-resolver-1.9.4-3.12.3.noarch",
                  "product_id": "ant-apache-resolver-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-apache-xalan2-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-apache-xalan2-1.9.4-3.12.3.noarch",
                  "product_id": "ant-apache-xalan2-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-commons-logging-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-commons-logging-1.9.4-3.12.3.noarch",
                  "product_id": "ant-commons-logging-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-commons-net-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-commons-net-1.9.4-3.12.3.noarch",
                  "product_id": "ant-commons-net-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-javadoc-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-javadoc-1.9.4-3.12.3.noarch",
                  "product_id": "ant-javadoc-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-javamail-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-javamail-1.9.4-3.12.3.noarch",
                  "product_id": "ant-javamail-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-jdepend-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-jdepend-1.9.4-3.12.3.noarch",
                  "product_id": "ant-jdepend-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-jmf-1.9.4-3.12.1.noarch",
                "product": {
                  "name": "ant-jmf-1.9.4-3.12.1.noarch",
                  "product_id": "ant-jmf-1.9.4-3.12.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-jsch-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-jsch-1.9.4-3.12.3.noarch",
                  "product_id": "ant-jsch-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-junit-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-junit-1.9.4-3.12.3.noarch",
                  "product_id": "ant-junit-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-manual-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-manual-1.9.4-3.12.3.noarch",
                  "product_id": "ant-manual-1.9.4-3.12.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-scripts-1.9.4-3.12.1.noarch",
                "product": {
                  "name": "ant-scripts-1.9.4-3.12.1.noarch",
                  "product_id": "ant-scripts-1.9.4-3.12.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-swing-1.9.4-3.12.1.noarch",
                "product": {
                  "name": "ant-swing-1.9.4-3.12.1.noarch",
                  "product_id": "ant-swing-1.9.4-3.12.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "ant-testutil-1.9.4-3.12.3.noarch",
                "product": {
                  "name": "ant-testutil-1.9.4-3.12.3.noarch",
                  "product_id": "ant-testutil-1.9.4-3.12.3.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-1.9.4-3.12.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.12.1.noarch"
        },
        "product_reference": "ant-1.9.4-3.12.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-antlr-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-antlr-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-apache-bcel-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-apache-bcel-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-apache-bsf-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-apache-bsf-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-apache-log4j-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-apache-log4j-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-apache-oro-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-apache-oro-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-apache-regexp-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-apache-regexp-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-apache-resolver-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-apache-resolver-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-commons-logging-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-commons-logging-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-javadoc-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-javadoc-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-javamail-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-javamail-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-jdepend-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-jdepend-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-jmf-1.9.4-3.12.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.12.1.noarch"
        },
        "product_reference": "ant-jmf-1.9.4-3.12.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-junit-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-junit-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-manual-1.9.4-3.12.3.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.12.3.noarch"
        },
        "product_reference": "ant-manual-1.9.4-3.12.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-scripts-1.9.4-3.12.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.12.1.noarch"
        },
        "product_reference": "ant-scripts-1.9.4-3.12.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-swing-1.9.4-3.12.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.12.1.noarch"
        },
        "product_reference": "ant-swing-1.9.4-3.12.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-1.9.4-3.12.1.noarch as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.12.1.noarch"
        },
        "product_reference": "ant-1.9.4-3.12.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ant-1.9.4-3.12.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.12.1.noarch"
        },
        "product_reference": "ant-1.9.4-3.12.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-11979",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-11979"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.12.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-11979",
          "url": "https://www.suse.com/security/cve/CVE-2020-11979"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177180 for CVE-2020-11979",
          "url": "https://bugzilla.suse.com/1177180"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.12.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.12.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-16T15:08:09Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-11979"
    },
    {
      "cve": "CVE-2020-1945",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-1945"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.12.3.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.12.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.12.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-1945",
          "url": "https://www.suse.com/security/cve/CVE-2020-1945"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1171696 for CVE-2020-1945",
          "url": "https://bugzilla.suse.com/1171696"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177180 for CVE-2020-1945",
          "url": "https://bugzilla.suse.com/1177180"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179729 for CVE-2020-1945",
          "url": "https://bugzilla.suse.com/1179729"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.12.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-antlr-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bcel-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-bsf-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-log4j-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-oro-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-regexp-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-apache-resolver-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-commons-logging-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javadoc-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-javamail-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jdepend-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-jmf-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-junit-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-manual-1.9.4-3.12.3.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-scripts-1.9.4-3.12.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:ant-swing-1.9.4-3.12.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-16T15:08:09Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-1945"
    }
  ]
}

CVE-2020-1945 (GCVE-0-2020-1945)

Vulnerability from cvelistv5 – Published: 2020-05-14 15:57 – Updated: 2024-08-04 06:54

Summary

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Severity ?

No CVSS data available.

CWE

insecure temporary file vulnerability

Assigner

apache

References

URL

Tags

	https://lists.apache.org/thread.html/rda80ac59119…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rfd346609527…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/re1ce84518d7…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r95dc943e47a…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rd7dda48ff83…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r1863b9ce4c3…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rdaa9c51d5dc…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r1b32c76afff…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r0d08a96ba9d…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r4b2904d64af…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r6edd3e2cb79…	mailing-listx_refsource_MLIST
	https://usn.ubuntu.com/4380-1/	vendor-advisoryx_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.apache.org/thread.html/r8e24abb7dd7…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r2704fb14ce0…	mailing-listx_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r8e592bbfc01…	x_refsource_MISC
	https://lists.apache.org/thread.html/r6e295d79203…	mailing-listx_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
	https://security.gentoo.org/glsa/202007-34	vendor-advisoryx_refsource_GENTOO
	https://lists.apache.org/thread.html/r815f88d1044…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r5dfc77048b1…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rc3c8ef9724b…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rb8ec556f176…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rc89e491b5b2…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rf07feaf78af…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r1a9c992d7c8…	mailing-listx_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2020/09/30/6	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r1dc8518dc99…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r4ca33fad3fb…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r107ea1b1a7a…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r2306b67f20c…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r5e1cdd79f01…	mailing-listx_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r3cea0f3da4f…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r6030d34ceac…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rce099751721…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r6970d196cd7…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/ra12c3e23b02…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/ra12c3e23b02…	mailing-listx_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2020/12/06/1	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/ra12c3e23b02…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/ra9dab34bf86…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rb860063819b…	mailing-listx_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://lists.apache.org/thread.html/raaeddc41da8…	mailing-listx_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://lists.apache.org/thread.html/rbfe9ba28b74…	mailing-listx_refsource_MLIST
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Apache Ant	Affected: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:54:00.377Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[creadur-dev] 20200518 [jira] [Created] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rda80ac59119558eaec452e58ddfac2ccc9211da1c65f7927682c78b1%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-commits] 20200518 [creadur-rat] 03/03: RAT-269: Update Apache ANT to fix CVE-2020-1945",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfd346609527a79662c48b1da3ac500ec30f29f7ddaa3575051e81890%40%3Ccommits.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-commits] 20200518 [creadur-rat] branch master updated: RAT-269: Update Apache ANT to fix CVE-2020-1945",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re1ce84518d773a94a613d988771daf9252c9cf7375a9a477009f9735%40%3Ccommits.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20200518 [jira] [Closed] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r95dc943e47a211d29df605e14f86c280fc9fa8d828b2b53bd07673c9%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20200518 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd7dda48ff835f4d0293949837d55541bfde3683bd35bd8431e324538%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20200518 [jira] [Assigned] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1863b9ce4c3e4b1e5b0c671ad05545ba3eb8399616aa746af5dfe1b1%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[groovy-notifications] 20200522 [jira] [Closed] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdaa9c51d5dc6560c9d2b3f3d742c768ad0705e154041e574a0fae45c%40%3Cnotifications.groovy.apache.org%3E"
          },
          {
            "name": "[hive-dev] 20200530 [jira] [Created] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1b32c76afffcf676e13ed635a3332f3e46e6aaa7722eb3fc7a28f58e%40%3Cdev.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200530 [jira] [Assigned] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r0d08a96ba9de8aa435f32944e8b2867c368a518d4ff57782e3637335%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200530 [jira] [Updated] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4b2904d64affd4266cd72ccb2fc3927c1c2f22009f183095aa46bf90%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200530 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6edd3e2cb79ee635630d891b54a4f1a9cd8c7f639d6ee34e75fbe830%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "USN-4380-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4380-1/"
          },
          {
            "name": "FEDORA-2020-52741b0a49",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRVAWTCVXJMRYKQKEXYSNBF7NLSR6OEI/"
          },
          {
            "name": "FEDORA-2020-7f07da3fef",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EQBR65TINSJRN7PTPIVNYS33P535WM74/"
          },
          {
            "name": "[hive-issues] 20200621 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8e24abb7dd77cda14c6df90a377c94f0a413bbfcec90a29540ff8adf%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20200703 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2704fb14ce068c64759a986f81d5b5e42ab434fa13d0f444ad52816b%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E"
          },
          {
            "name": "[db-torque-dev] 20200715 svn commit: r1879896 - in /db/torque/torque4/trunk: ./ torque-ant-tasks/ torque-ant-tasks/src/test/java/org/apache/torque/ant/task/ torque-generator/src/main/java/org/apache/torque/generator/control/ torque-generator/src/main/java/org/apache/torque/gen...",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6e295d792032ec02b32be3846c21a58857fba4a077d22c5842d69ba2%40%3Ctorque-dev.db.apache.org%3E"
          },
          {
            "name": "openSUSE-SU-2020:1022",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00053.html"
          },
          {
            "name": "GLSA-202007-34",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202007-34"
          },
          {
            "name": "[hive-issues] 20200804 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r815f88d1044760176f30a4913b4baacd06f3eae4eb662de7388e46d8%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[myfaces-commits] 20200826 [myfaces-tobago] branch tobago-2.x updated: update ant because of CVE-2020-1945",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5dfc77048b1f9db26622dce91a6edf083d499397256594952fad5f35%40%3Ccommits.myfaces.apache.org%3E"
          },
          {
            "name": "[ant-dev] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E"
          },
          {
            "name": "[announce] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb8ec556f176c83547b959150e2108e2ddf1d61224295941908b0a81f%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[ant-user] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc89e491b5b270fb40f1210b70554527b737c217ad2e831b643ead6bc%40%3Cuser.ant.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20200930 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf07feaf78afc8f701e21948a06ef92565d3dff1242d710f4fbf900b2%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20200930 [jira] [Created] (RAT-274) Update to latest Ant in order to fix CVE-2020-11979",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1a9c992d7c8219dc15b4ad448649f0ffdaa88d76ef6a0035c49455f5%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[oss-security] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/09/30/6"
          },
          {
            "name": "[creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "name": "[hive-issues] 20201022 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3cea0f3da4f6d06d7afb6c0804da8e01773a0f50a09b8d9beb2cda65%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[groovy-notifications] 20201126 [jira] [Updated] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6030d34ceacd0098538425c5dac8251ffc7fd90b886942bc7ef87858%40%3Cnotifications.groovy.apache.org%3E"
          },
          {
            "name": "[groovy-notifications] 20201126 [jira] [Comment Edited] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rce099751721c26a8166d8b6578293820832831a0b2cb8d93b8efa081%40%3Cnotifications.groovy.apache.org%3E"
          },
          {
            "name": "[groovy-commits] 20201126 [groovy] branch GROOVY_2_4_X updated: GROOVY-9552: Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6970d196cd73863dafdbc3a7052562deedd338e3bd7d73d8171d92d6%40%3Ccommits.groovy.apache.org%3E"
          },
          {
            "name": "[groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E"
          },
          {
            "name": "[groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E"
          },
          {
            "name": "[oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/12/06/1"
          },
          {
            "name": "[announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E"
          },
          {
            "name": "[myfaces-commits] 20201211 [myfaces-tobago] 02/22: update ant because of CVE-2020-1945",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb860063819b9c0990e1fbce29d83f4554766fe5a05e3b3939736bf2b%40%3Ccommits.myfaces.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "name": "[creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "name": "[creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Ant",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "insecure temporary file vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-07T14:40:33",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[creadur-dev] 20200518 [jira] [Created] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rda80ac59119558eaec452e58ddfac2ccc9211da1c65f7927682c78b1%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-commits] 20200518 [creadur-rat] 03/03: RAT-269: Update Apache ANT to fix CVE-2020-1945",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfd346609527a79662c48b1da3ac500ec30f29f7ddaa3575051e81890%40%3Ccommits.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-commits] 20200518 [creadur-rat] branch master updated: RAT-269: Update Apache ANT to fix CVE-2020-1945",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/re1ce84518d773a94a613d988771daf9252c9cf7375a9a477009f9735%40%3Ccommits.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20200518 [jira] [Closed] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r95dc943e47a211d29df605e14f86c280fc9fa8d828b2b53bd07673c9%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20200518 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd7dda48ff835f4d0293949837d55541bfde3683bd35bd8431e324538%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20200518 [jira] [Assigned] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1863b9ce4c3e4b1e5b0c671ad05545ba3eb8399616aa746af5dfe1b1%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[groovy-notifications] 20200522 [jira] [Closed] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdaa9c51d5dc6560c9d2b3f3d742c768ad0705e154041e574a0fae45c%40%3Cnotifications.groovy.apache.org%3E"
        },
        {
          "name": "[hive-dev] 20200530 [jira] [Created] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1b32c76afffcf676e13ed635a3332f3e46e6aaa7722eb3fc7a28f58e%40%3Cdev.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200530 [jira] [Assigned] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r0d08a96ba9de8aa435f32944e8b2867c368a518d4ff57782e3637335%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200530 [jira] [Updated] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4b2904d64affd4266cd72ccb2fc3927c1c2f22009f183095aa46bf90%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200530 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r6edd3e2cb79ee635630d891b54a4f1a9cd8c7f639d6ee34e75fbe830%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "USN-4380-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4380-1/"
        },
        {
          "name": "FEDORA-2020-52741b0a49",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRVAWTCVXJMRYKQKEXYSNBF7NLSR6OEI/"
        },
        {
          "name": "FEDORA-2020-7f07da3fef",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EQBR65TINSJRN7PTPIVNYS33P535WM74/"
        },
        {
          "name": "[hive-issues] 20200621 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8e24abb7dd77cda14c6df90a377c94f0a413bbfcec90a29540ff8adf%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20200703 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r2704fb14ce068c64759a986f81d5b5e42ab434fa13d0f444ad52816b%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E"
        },
        {
          "name": "[db-torque-dev] 20200715 svn commit: r1879896 - in /db/torque/torque4/trunk: ./ torque-ant-tasks/ torque-ant-tasks/src/test/java/org/apache/torque/ant/task/ torque-generator/src/main/java/org/apache/torque/generator/control/ torque-generator/src/main/java/org/apache/torque/gen...",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r6e295d792032ec02b32be3846c21a58857fba4a077d22c5842d69ba2%40%3Ctorque-dev.db.apache.org%3E"
        },
        {
          "name": "openSUSE-SU-2020:1022",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00053.html"
        },
        {
          "name": "GLSA-202007-34",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202007-34"
        },
        {
          "name": "[hive-issues] 20200804 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r815f88d1044760176f30a4913b4baacd06f3eae4eb662de7388e46d8%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[myfaces-commits] 20200826 [myfaces-tobago] branch tobago-2.x updated: update ant because of CVE-2020-1945",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5dfc77048b1f9db26622dce91a6edf083d499397256594952fad5f35%40%3Ccommits.myfaces.apache.org%3E"
        },
        {
          "name": "[ant-dev] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E"
        },
        {
          "name": "[announce] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb8ec556f176c83547b959150e2108e2ddf1d61224295941908b0a81f%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[ant-user] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc89e491b5b270fb40f1210b70554527b737c217ad2e831b643ead6bc%40%3Cuser.ant.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20200930 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf07feaf78afc8f701e21948a06ef92565d3dff1242d710f4fbf900b2%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20200930 [jira] [Created] (RAT-274) Update to latest Ant in order to fix CVE-2020-11979",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1a9c992d7c8219dc15b4ad448649f0ffdaa88d76ef6a0035c49455f5%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[oss-security] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/09/30/6"
        },
        {
          "name": "[creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "name": "[hive-issues] 20201022 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3cea0f3da4f6d06d7afb6c0804da8e01773a0f50a09b8d9beb2cda65%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[groovy-notifications] 20201126 [jira] [Updated] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r6030d34ceacd0098538425c5dac8251ffc7fd90b886942bc7ef87858%40%3Cnotifications.groovy.apache.org%3E"
        },
        {
          "name": "[groovy-notifications] 20201126 [jira] [Comment Edited] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rce099751721c26a8166d8b6578293820832831a0b2cb8d93b8efa081%40%3Cnotifications.groovy.apache.org%3E"
        },
        {
          "name": "[groovy-commits] 20201126 [groovy] branch GROOVY_2_4_X updated: GROOVY-9552: Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r6970d196cd73863dafdbc3a7052562deedd338e3bd7d73d8171d92d6%40%3Ccommits.groovy.apache.org%3E"
        },
        {
          "name": "[groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E"
        },
        {
          "name": "[groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E"
        },
        {
          "name": "[oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/12/06/1"
        },
        {
          "name": "[announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E"
        },
        {
          "name": "[myfaces-commits] 20201211 [myfaces-tobago] 02/22: update ant because of CVE-2020-1945",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb860063819b9c0990e1fbce29d83f4554766fe5a05e3b3939736bf2b%40%3Ccommits.myfaces.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "name": "[creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "name": "[creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-1945",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Ant",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "insecure temporary file vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[creadur-dev] 20200518 [jira] [Created] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rda80ac59119558eaec452e58ddfac2ccc9211da1c65f7927682c78b1@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-commits] 20200518 [creadur-rat] 03/03: RAT-269: Update Apache ANT to fix CVE-2020-1945",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfd346609527a79662c48b1da3ac500ec30f29f7ddaa3575051e81890@%3Ccommits.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-commits] 20200518 [creadur-rat] branch master updated: RAT-269: Update Apache ANT to fix CVE-2020-1945",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/re1ce84518d773a94a613d988771daf9252c9cf7375a9a477009f9735@%3Ccommits.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20200518 [jira] [Closed] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r95dc943e47a211d29df605e14f86c280fc9fa8d828b2b53bd07673c9@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20200518 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd7dda48ff835f4d0293949837d55541bfde3683bd35bd8431e324538@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20200518 [jira] [Assigned] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1863b9ce4c3e4b1e5b0c671ad05545ba3eb8399616aa746af5dfe1b1@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[groovy-notifications] 20200522 [jira] [Closed] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdaa9c51d5dc6560c9d2b3f3d742c768ad0705e154041e574a0fae45c@%3Cnotifications.groovy.apache.org%3E"
            },
            {
              "name": "[hive-dev] 20200530 [jira] [Created] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1b32c76afffcf676e13ed635a3332f3e46e6aaa7722eb3fc7a28f58e@%3Cdev.hive.apache.org%3E"
            },
            {
              "name": "[hive-issues] 20200530 [jira] [Assigned] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r0d08a96ba9de8aa435f32944e8b2867c368a518d4ff57782e3637335@%3Cissues.hive.apache.org%3E"
            },
            {
              "name": "[hive-issues] 20200530 [jira] [Updated] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4b2904d64affd4266cd72ccb2fc3927c1c2f22009f183095aa46bf90@%3Cissues.hive.apache.org%3E"
            },
            {
              "name": "[hive-issues] 20200530 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r6edd3e2cb79ee635630d891b54a4f1a9cd8c7f639d6ee34e75fbe830@%3Cissues.hive.apache.org%3E"
            },
            {
              "name": "USN-4380-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4380-1/"
            },
            {
              "name": "FEDORA-2020-52741b0a49",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRVAWTCVXJMRYKQKEXYSNBF7NLSR6OEI/"
            },
            {
              "name": "FEDORA-2020-7f07da3fef",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EQBR65TINSJRN7PTPIVNYS33P535WM74/"
            },
            {
              "name": "[hive-issues] 20200621 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8e24abb7dd77cda14c6df90a377c94f0a413bbfcec90a29540ff8adf@%3Cissues.hive.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20200703 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r2704fb14ce068c64759a986f81d5b5e42ab434fa13d0f444ad52816b@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E"
            },
            {
              "name": "[db-torque-dev] 20200715 svn commit: r1879896 - in /db/torque/torque4/trunk: ./ torque-ant-tasks/ torque-ant-tasks/src/test/java/org/apache/torque/ant/task/ torque-generator/src/main/java/org/apache/torque/generator/control/ torque-generator/src/main/java/org/apache/torque/gen...",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r6e295d792032ec02b32be3846c21a58857fba4a077d22c5842d69ba2@%3Ctorque-dev.db.apache.org%3E"
            },
            {
              "name": "openSUSE-SU-2020:1022",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00053.html"
            },
            {
              "name": "GLSA-202007-34",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202007-34"
            },
            {
              "name": "[hive-issues] 20200804 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r815f88d1044760176f30a4913b4baacd06f3eae4eb662de7388e46d8@%3Cissues.hive.apache.org%3E"
            },
            {
              "name": "[myfaces-commits] 20200826 [myfaces-tobago] branch tobago-2.x updated: update ant because of CVE-2020-1945",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5dfc77048b1f9db26622dce91a6edf083d499397256594952fad5f35@%3Ccommits.myfaces.apache.org%3E"
            },
            {
              "name": "[ant-dev] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea@%3Cdev.ant.apache.org%3E"
            },
            {
              "name": "[announce] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb8ec556f176c83547b959150e2108e2ddf1d61224295941908b0a81f@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[ant-user] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc89e491b5b270fb40f1210b70554527b737c217ad2e831b643ead6bc@%3Cuser.ant.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20200930 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf07feaf78afc8f701e21948a06ef92565d3dff1242d710f4fbf900b2@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20200930 [jira] [Created] (RAT-274) Update to latest Ant in order to fix CVE-2020-11979",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1a9c992d7c8219dc15b4ad448649f0ffdaa88d76ef6a0035c49455f5@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[oss-security] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/09/30/6"
            },
            {
              "name": "[creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "[hive-issues] 20201022 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r3cea0f3da4f6d06d7afb6c0804da8e01773a0f50a09b8d9beb2cda65@%3Cissues.hive.apache.org%3E"
            },
            {
              "name": "[groovy-notifications] 20201126 [jira] [Updated] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r6030d34ceacd0098538425c5dac8251ffc7fd90b886942bc7ef87858@%3Cnotifications.groovy.apache.org%3E"
            },
            {
              "name": "[groovy-notifications] 20201126 [jira] [Comment Edited] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rce099751721c26a8166d8b6578293820832831a0b2cb8d93b8efa081@%3Cnotifications.groovy.apache.org%3E"
            },
            {
              "name": "[groovy-commits] 20201126 [groovy] branch GROOVY_2_4_X updated: GROOVY-9552: Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r6970d196cd73863dafdbc3a7052562deedd338e3bd7d73d8171d92d6@%3Ccommits.groovy.apache.org%3E"
            },
            {
              "name": "[groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967@%3Cusers.groovy.apache.org%3E"
            },
            {
              "name": "[groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967@%3Cdev.groovy.apache.org%3E"
            },
            {
              "name": "[oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosure",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/12/06/1"
            },
            {
              "name": "[announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E"
            },
            {
              "name": "[myfaces-commits] 20201211 [myfaces-tobago] 02/22: update ant because of CVE-2020-1945",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb860063819b9c0990e1fbce29d83f4554766fe5a05e3b3939736bf2b@%3Ccommits.myfaces.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "[creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "[creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-1945",
    "datePublished": "2020-05-14T15:57:34",
    "dateReserved": "2019-12-02T00:00:00",
    "dateUpdated": "2024-08-04T06:54:00.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11979 (GCVE-0-2020-11979)

Vulnerability from cvelistv5 – Published: 2020-10-01 19:24 – Updated: 2024-08-04 11:48

Summary

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Severity ?

No CVSS data available.

CWE

insecure temporary file vulnerability
CWE-379 - Creation of Temporary File in Directory with Incorrect Permissions

Assigner

apache

References

URL

	Vendor	Product	Version
	n/a	Apache Ant	Affected: Apache Ant 1.10.8

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2022:4022-1

CVE-2020-1945 (GCVE-0-2020-1945)

CVE-2020-11979 (GCVE-0-2020-11979)

Tags

Sightings

Nomenclature