CVE-2020-11979 is a high-severity vulnerability affecting Apache Ant versions 1.10.8 and earlier, as well as products like Fedora, Gradle, and Oracle that utilize it. It stems from an incomplete fix for a prior vulnerability, where the fixcrlf task in Ant would delete and recreate temporary files without proper permission restrictions, allowing an attacker to inject malicious code into the build process. With a CVSS score of 7.5, this network-exploitable flaw has a high impact on integrity, though it does not affect confidentiality or availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.10.8CPE matchmatch criteria | cpe:2.3:a:apache:ant:1.10.8:*:*:*:*:*:*:* | ||
< 6.8.0CPE matchmatch criteria | cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:* | ||
31CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | ||
32CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Code injection in Apache Ant
Feb 3, 2021As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Oct 13, 2020ant: insecure temporary file
Oct 1, 2020