CVE-2020-1945

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 14-05-2020 06:15

Last modified: - 04-04-2022 03:31

Total changes: - 12

Description

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

High

Attack complexity

Local

Attack vector

None

Availability

High

Confidentiality

High

Integrity

Low

Privileges required

Unchanged

Scope

None

User interaction

6.3

Base score

1.0

5.2

Exploitability score

Impact score

Verification logic

vendor=apache AND product=ant AND versionEndIncluding=1.9.14 AND versionStartIncluding=1.1

vendor=apache AND product=ant AND versionEndIncluding=1.10.7 AND versionStartIncluding=1.10.0

vendor=canonical AND product=ubuntu_linux AND version=19.10

vendor=fedoraproject AND product=fedora AND version=31

vendor=fedoraproject AND product=fedora AND version=32

vendor=opensuse AND product=leap AND version=15.2

vendor=oracle AND product=agile_engineering_data_management AND version=6.2.1.0

vendor=oracle AND product=banking_enterprise_collections AND versionEndIncluding=2.9.0 AND versionStartIncluding=2.7.0

vendor=oracle AND product=banking_liquidity_management AND versionEndIncluding=14.4.0 AND versionStartIncluding=14.0.0

vendor=oracle AND product=banking_platform AND versionEndIncluding=2.9.0 AND versionStartIncluding=2.4.0

vendor=oracle AND product=business_process_management_suite AND version=12.2.1.3.0

vendor=oracle AND product=business_process_management_suite AND version=12.2.1.4.0

vendor=oracle AND product=category_management_planning_\&_optimization AND version=15.0.3

vendor=oracle AND product=communications_asap AND version=7.3

vendor=oracle AND product=communications_diameter_signaling_router AND versionEndIncluding=8.2.2 AND versionStartIncluding=8.0.0

vendor=oracle AND product=communications_metasolv_solution AND version=6.3.0

vendor=oracle AND product=communications_order_and_service_management AND version=7.3

vendor=oracle AND product=communications_order_and_service_management AND version=7.4

vendor=oracle AND product=data_integrator AND version=12.2.1.3.0

vendor=oracle AND product=data_integrator AND version=12.2.1.4.0

vendor=oracle AND product=endeca_information_discovery_studio AND version=3.2.0

vendor=oracle AND product=enterprise_manager_ops_center AND version=12.4.0.0

vendor=oracle AND product=enterprise_repository AND version=11.1.1.7.0

vendor=oracle AND product=financial_services_analytical_applications_infrastructure AND versionEndIncluding=8.1.0 AND versionStartIncluding=8.0.6

vendor=oracle AND product=flexcube_investor_servicing AND version=12.1.0

vendor=oracle AND product=flexcube_investor_servicing AND version=12.3.0

vendor=oracle AND product=flexcube_investor_servicing AND version=12.4.0

vendor=oracle AND product=flexcube_investor_servicing AND version=14.0.0

vendor=oracle AND product=flexcube_investor_servicing AND version=14.1.0

vendor=oracle AND product=flexcube_private_banking AND version=12.0.0

vendor=oracle AND product=flexcube_private_banking AND version=12.1.0

vendor=oracle AND product=health_sciences_information_manager AND versionEndIncluding=3.0.2 AND versionStartIncluding=3.0

vendor=oracle AND product=primavera_gateway AND versionEndIncluding=16.2.11 AND versionStartIncluding=16.2.0

vendor=oracle AND product=primavera_gateway AND versionEndIncluding=17.12.7 AND versionStartIncluding=17.12.0

vendor=oracle AND product=primavera_unifier AND version=16.1

vendor=oracle AND product=primavera_unifier AND version=16.2

vendor=oracle AND product=primavera_unifier AND versionEndIncluding=17.12 AND versionStartIncluding=17.7

vendor=oracle AND product=primavera_unifier AND version=18.8

vendor=oracle AND product=primavera_unifier AND version=19.12

vendor=oracle AND product=rapid_planning AND version=12.1

vendor=oracle AND product=rapid_planning AND version=12.2

vendor=oracle AND product=real-time_decision_server AND version=3.2.1.0

vendor=oracle AND product=retail_advanced_inventory_planning AND version=14.1

vendor=oracle AND product=retail_advanced_inventory_planning AND version=15.0

vendor=oracle AND product=retail_advanced_inventory_planning AND version=16.0

vendor=oracle AND product=retail_assortment_planning AND version=15.0.3

vendor=oracle AND product=retail_assortment_planning AND version=16.0.3

vendor=oracle AND product=retail_back_office AND version=14.0

vendor=oracle AND product=retail_back_office AND version=14.1

vendor=oracle AND product=retail_bulk_data_integration AND version=15.0

vendor=oracle AND product=retail_bulk_data_integration AND version=16.0

vendor=oracle AND product=retail_bulk_data_integration AND version=16.0.3.0

vendor=oracle AND product=retail_bulk_data_integration AND version=19.0.1

vendor=oracle AND product=retail_central_office AND version=14.0

vendor=oracle AND product=retail_central_office AND version=14.1

vendor=oracle AND product=retail_data_extractor_for_merchandising AND version=1.9

vendor=oracle AND product=retail_data_extractor_for_merchandising AND version=1.10

vendor=oracle AND product=retail_extract_transform_and_load AND version=13.2.5

vendor=oracle AND product=retail_extract_transform_and_load AND version=13.2.8

vendor=oracle AND product=retail_financial_integration AND version=14.1.3.2

vendor=oracle AND product=retail_financial_integration AND version=15.0

vendor=oracle AND product=retail_financial_integration AND version=15.0.4.0

vendor=oracle AND product=retail_financial_integration AND version=16.0

vendor=oracle AND product=retail_financial_integration AND version=16.0.3.0

vendor=oracle AND product=retail_integration_bus AND version=14.1

vendor=oracle AND product=retail_integration_bus AND version=14.1.3.2

vendor=oracle AND product=retail_integration_bus AND version=15.0

vendor=oracle AND product=retail_integration_bus AND version=15.0.4.0

vendor=oracle AND product=retail_integration_bus AND version=16.0

vendor=oracle AND product=retail_integration_bus AND version=16.0.3.0

vendor=oracle AND product=retail_integration_bus AND version=19.0.1.0

vendor=oracle AND product=retail_item_planning AND version=15.0.3

vendor=oracle AND product=retail_macro_space_optimization AND version=15.0.3

vendor=oracle AND product=retail_merchandise_financial_planning AND version=15.0.3

vendor=oracle AND product=retail_merchandising_system AND version=19.0.1

vendor=oracle AND product=retail_point-of-service AND version=14.0

vendor=oracle AND product=retail_point-of-service AND version=14.1

vendor=oracle AND product=retail_point-of-service AND version=15.0

vendor=oracle AND product=retail_point-of-service AND version=16.0

vendor=oracle AND product=retail_predictive_application_server AND version=14.0.3

vendor=oracle AND product=retail_predictive_application_server AND version=14.1.3

vendor=oracle AND product=retail_predictive_application_server AND version=15.0.3

vendor=oracle AND product=retail_predictive_application_server AND version=16.0.3

vendor=oracle AND product=retail_predictive_application_server AND version=16.0.3.0

vendor=oracle AND product=retail_regular_price_optimization AND version=15.0.3

vendor=oracle AND product=retail_regular_price_optimization AND version=16.0.3

vendor=oracle AND product=retail_replenishment_optimization AND version=15.0.3

vendor=oracle AND product=retail_returns_management AND version=14.0

vendor=oracle AND product=retail_returns_management AND version=14.1

vendor=oracle AND product=retail_service_backbone AND version=14.1.3.2

vendor=oracle AND product=retail_service_backbone AND version=15.0

vendor=oracle AND product=retail_service_backbone AND version=15.0.4.0

vendor=oracle AND product=retail_service_backbone AND version=16.0

vendor=oracle AND product=retail_service_backbone AND version=16.0.3.0

vendor=oracle AND product=retail_service_backbone AND version=19.0.1.0

vendor=oracle AND product=retail_size_profile_optimization AND version=15.0.3

vendor=oracle AND product=retail_size_profile_optimization AND version=16.0.3

vendor=oracle AND product=retail_store_inventory_management AND version=14.0.4

vendor=oracle AND product=retail_store_inventory_management AND version=14.1

vendor=oracle AND product=retail_store_inventory_management AND version=14.1.3

vendor=oracle AND product=retail_store_inventory_management AND version=15.0

vendor=oracle AND product=retail_store_inventory_management AND version=15.0.3

vendor=oracle AND product=retail_store_inventory_management AND version=16.0

vendor=oracle AND product=retail_store_inventory_management AND version=16.0.3

vendor=oracle AND product=retail_xstore_point_of_service AND version=15.0.4

vendor=oracle AND product=retail_xstore_point_of_service AND version=16.0.6

vendor=oracle AND product=retail_xstore_point_of_service AND version=17.0.4

vendor=oracle AND product=retail_xstore_point_of_service AND version=18.0.3

vendor=oracle AND product=retail_xstore_point_of_service AND version=19.0.2

vendor=oracle AND product=timesten_in-memory_database AND versionEndExcluding=11.2.2.8.27

vendor=oracle AND product=timesten_in-memory_database AND version=11.2.2.8.49

vendor=oracle AND product=utilities_framework AND version=2.2.0.0.0

vendor=oracle AND product=utilities_framework AND version=4.2.0.2.0

vendor=oracle AND product=utilities_framework AND version=4.2.0.3.0

vendor=oracle AND product=utilities_framework AND versionEndIncluding=4.3.0.6.0 AND versionStartIncluding=4.3.0.1.0

vendor=oracle AND product=utilities_framework AND version=4.4.0.0.0

vendor=oracle AND product=utilities_framework AND version=4.4.0.2.0

Reference

https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E
[creadur-dev] 20200518 [jira] [Closed] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Mitigation, Patch, Vendor Advisory
[creadur-dev] 20200518 [jira] [Assigned] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Mitigation, Patch, Vendor Advisory
[creadur-commits] 20200518 [creadur-rat] branch master updated: RAT-269: Update Apache ANT to fix CVE-2020-1945-Mailing List, Patch, Vendor Advisory
[creadur-commits] 20200518 [creadur-rat] 03/03: RAT-269: Update Apache ANT to fix CVE-2020-1945-Patch, Vendor Advisory
[creadur-dev] 20200518 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Mitigation, Patch, Vendor Advisory
[creadur-dev] 20200518 [jira] [Created] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mitigation, Vendor Advisory
[groovy-notifications] 20200522 [jira] [Closed] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability-Mailing List, Vendor Advisory
[hive-issues] 20200530 [jira] [Assigned] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
[hive-dev] 20200530 [jira] [Created] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
[hive-issues] 20200530 [jira] [Updated] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
[hive-issues] 20200530 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
FEDORA-2020-52741b0a49-Mailing List, Vendor Advisory
FEDORA-2020-7f07da3fef-Mailing List, Vendor Advisory
USN-4380-1-Mailing List, Vendor Advisory
[hive-issues] 20200621 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
[creadur-dev] 20200703 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
[db-torque-dev] 20200715 svn commit: r1879896 - in /db/torque/torque4/trunk: ./ torque-ant-tasks/ torque-ant-tasks/src/test/java/org/apache/torque/ant/task/ torque-generator/src/main/java/org/apache/torque/generator/control/ torque-generator/src/main/java/org/apache/torque/gen...-Mailing List, Patch, Vendor Advisory
openSUSE-SU-2020:1022-Mailing List, Third Party Advisory
GLSA-202007-34-Third Party Advisory
[hive-issues] 20200804 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
[myfaces-commits] 20200826 [myfaces-tobago] branch tobago-2.x updated: update ant because of CVE-2020-1945-Mailing List, Patch, Vendor Advisory
[ant-dev] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability-Mailing List, Vendor Advisory
[announce] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability-Mailing List, Vendor Advisory
[ant-user] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability-Mailing List, Vendor Advisory
[creadur-dev] 20200930 [jira] [Created] (RAT-274) Update to latest Ant in order to fix CVE-2020-11979-Mailing List, Vendor Advisory
[creadur-dev] 20200930 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979-Mailing List, Vendor Advisory
[oss-security] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability-Mailing List, Third Party Advisory
[creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979-Mailing List, Vendor Advisory
[creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979-Mailing List, Vendor Advisory
[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8-Mailing List, Vendor Advisory
[creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979-Mailing List, Vendor Advisory
[creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8-Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
[hive-issues] 20201022 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT-Mailing List, Vendor Advisory
[groovy-notifications] 20201126 [jira] [Updated] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability-Mailing List, Vendor Advisory
[groovy-commits] 20201126 [groovy] branch GROOVY_2_4_X updated: GROOVY-9552: Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability-Mailing List, Patch, Vendor Advisory
[groovy-notifications] 20201126 [jira] [Comment Edited] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability-Mailing List, Vendor Advisory
[groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure-Mailing List, Vendor Advisory
[groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure-Mailing List, Vendor Advisory
[oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosure-Mailing List, Third Party Advisory
[announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure-Mailing List, Vendor Advisory
[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure-Mailing List, Vendor Advisory
[myfaces-commits] 20201211 [myfaces-tobago] 02/22: update ant because of CVE-2020-1945-Mailing List, Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
[creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8-Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
[creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8-Mailing List, Vendor Advisory
N/A-Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpujan2022.html

Keywords

CVE-2020-1945

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2020-1945

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures