CVE-2020-11979

Fixed in a distro release EPSS 8%

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Published 2020-10-01 · CVE record · OSV

Products: apache ant, gradle, fedoraproject fedora, oracle agile_engineering_data_management, oracle api_gateway, oracle banking_platform, oracle banking_treasury_management, oracle communications_unified_inventory_management, oracle data_integrator, oracle endeca_information_discovery_studio, oracle enterprise_repository, oracle financial_services_analytical_applications_infrastructure, oracle flexcube_private_banking, oracle primavera_gateway, oracle primavera_unifier, oracle real-time_decision_server, oracle retail_advanced_inventory_planning, oracle retail_assortment_planning, oracle retail_category_management_planning_&_optimization, oracle retail_eftlink, oracle retail_financial_integration, oracle retail_integration_bus, oracle retail_item_planning, oracle retail_macro_space_optimization, oracle retail_merchandise_financial_planning, oracle retail_merchandising_system, oracle retail_predictive_application_server, oracle retail_regular_price_optimization, oracle retail_replenishment_optimization, oracle retail_service_backbone, oracle retail_size_profile_optimization, oracle retail_store_inventory_management, oracle retail_xstore_point_of_service, oracle storagetek_acsls, oracle storagetek_tape_analytics, oracle timesten_in-memory_database, oracle utilities_framework

Fixed upstream

Distro releases