High severity · published Oct 1, 2020
CVE-2020-11979
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them
7.5
CVSS
7.8%
EPSS
No
On KEV
Description
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.8% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Ant ·
Apache Ant 1.10.8 · source: vendor
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
AN
Ant · Apache
1.10.8 · source: NVD
AG
Api Gateway · Oracle
11.1.2.4.0 · source: NVD
BP
Banking Platform · Oracle
2.4.0; 2.4.1; 2.6.2; 2.7.0; 2.7.1; 2.8.0 · source: NVD
BT
Banking Treasury Management · Oracle
14.4 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.4.0; 7.4.1 · source: NVD
DI
Data Integrator · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
EI
Endeca Information Discovery Studio · Oracle
3.2.0.0 · source: NVD
ER
Enterprise Repository · Oracle
11.1.1.7.0 · source: NVD
FE
Fedora · Fedoraproject
31; 32; 33 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.6 through 8.0.9; 8.1.0; 8.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11979
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11979
Third Party Advisory
https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm
lists.apache.org
https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E