← Back

CVE-2020-11979

nvd nist
Published: Oct 1, 2020Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Affected (71)

Products: Apache: Ant · Gradle: Gradle · Fedoraproject: Fedora · +1 more
Show all products
Apache: Ant · Gradle: Gradle · Fedoraproject: Fedora · Oracle: Agile Engineering Data Management, Api Gateway, Banking Platform, Banking Treasury Management, Communications Unified Inventory Management, Data Integrator, Endeca Information Discovery Studio, Enterprise Repository, Financial Services Analytical Applications Infrastructure, Flexcube Private Banking, Primavera Gateway, Primavera Unifier, Real Time Decision Server, Retail Advanced Inventory Planning, Retail Assortment Planning, Retail Category Management Planning & Optimization, Retail Eftlink, Retail Financial Integration, Retail Integration Bus, Retail Item Planning, Retail Macro Space Optimization, Retail Merchandise Financial Planning, Retail Merchandising System, Retail Predictive Application Server, Retail Regular Price Optimization, Retail Replenishment Optimization, Retail Service Backbone, Retail Size Profile Optimization, Retail Store Inventory Management, Retail Xstore Point Of Service, Storagetek Acsls, Storagetek Tape Analytics, Timesten In Memory Database, Utilities Framework
Apache
1 product
Ant
Gradle
1 product
Gradle
Fedoraproject
1 product
Fedora
Oracle
34 products
Agile Engineering Data Management
Api Gateway
Banking Platform
Banking Treasury Management
Communications Unified Inventory Management
Data Integrator
Endeca Information Discovery Studio
Enterprise Repository
Financial Services Analytical Applications Infrastructure
Flexcube Private Banking
Primavera Gateway
Primavera Unifier
Real Time Decision Server
Retail Advanced Inventory Planning
Retail Assortment Planning
Retail Category Management Planning & Optimization
Retail Eftlink
Retail Financial Integration
Retail Integration Bus
Retail Item Planning
Retail Macro Space Optimization
Retail Merchandise Financial Planning
Retail Merchandising System
Retail Predictive Application Server
Retail Regular Price Optimization
Retail Replenishment Optimization
Retail Service Backbone
Retail Size Profile Optimization
Retail Store Inventory Management
Retail Xstore Point Of Service
Storagetek Acsls
Storagetek Tape Analytics
Timesten In Memory Database
Utilities Framework
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Ant
Version 1.10.8
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Gradle
Before 6.8.0
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 31
Fedora
Version 32
Fedora
Version 33
Configuration D
66 vulnerable
Vulnerable SoftwareAffected Versions
Agile Engineering Data Management
Version 6.2.1.0
Api Gateway
Version 11.1.2.4.0
Oracle
Banking Platform
Version 2.4.0
Banking Platform
Version 2.4.1
Banking Platform
Version 2.6.2
Banking Platform
Version 2.7.0
Banking Platform
Version 2.7.1
Banking Platform
Version 2.8.0
Banking Treasury Management
Version 14.4
Oracle
Communications Unified Inventory Management
Version 7.4.0
Communications Unified Inventory Management
Version 7.4.1
Oracle
Data Integrator
Version 12.2.1.3.0
Data Integrator
Version 12.2.1.4.0
Endeca Information Discovery Studio
Version 3.2.0.0
Enterprise Repository
Version 11.1.1.7.0
Oracle
Financial Services Analytical Applications Infrastructure
From 8.0.6 to 8.0.9
Financial Services Analytical Applications Infrastructure
Version 8.1.0
Financial Services Analytical Applications Infrastructure
Version 8.1.1
Oracle
Flexcube Private Banking
Version 12.0.0
Flexcube Private Banking
Version 12.1.0
Oracle
Primavera Gateway
From 16.2.0 to 16.2.11
Primavera Gateway
From 17.12.0 to 17.12.9
Oracle
Primavera Unifier
From 17.7 to 17.12
Primavera Unifier
Version 16.1
Primavera Unifier
Version 16.2
Primavera Unifier
Version 18.8
Primavera Unifier
Version 19.12
Primavera Unifier
Version 20.12
Oracle
Real Time Decision Server
Version 11.1.1.9.0
Real Time Decision Server
Version 3.2.0.0
Retail Advanced Inventory Planning
Version 14.1
Retail Assortment Planning
Version 16.0.3
Retail Category Management Planning & Optimization
Version 16.0.3
Oracle
Retail Eftlink
Version 19.0.1
Retail Eftlink
Version 20.0.0
Oracle
Retail Financial Integration
Version 14.1.3
Retail Financial Integration
Version 15.0.3
Retail Financial Integration
Version 16.0.3
Retail Integration Bus
Version 15.0.3
Retail Item Planning
Version 16.0.3
Retail Macro Space Optimization
Version 16.0.3
Retail Merchandise Financial Planning
Version 16.0.3
Oracle
Retail Merchandising System
Version 14.1.3.2
Retail Merchandising System
Version 16.0.3
Retail Predictive Application Server
Version 14.1
Retail Regular Price Optimization
Version 16.0.3
Retail Replenishment Optimization
Version 16.0.3
Oracle
Retail Service Backbone
Version 14.1.3
Retail Service Backbone
Version 15.0.3
Retail Service Backbone
Version 16.0.3
Retail Size Profile Optimization
Version 16.0.3
Oracle
Retail Store Inventory Management
Version 14.1.3.9
Retail Store Inventory Management
Version 15.0.3.0
Retail Store Inventory Management
Version 16.0.3.0
Oracle
Retail Xstore Point Of Service
Version 15.0.4
Retail Xstore Point Of Service
Version 16.0.6
Retail Xstore Point Of Service
Version 17.0.4
Retail Xstore Point Of Service
Version 18.0.3
Retail Xstore Point Of Service
Version 19.0.2
Storagetek Acsls
Version 8.5.1
Storagetek Tape Analytics
Version 2.4
Timesten In Memory Database
Before 11.2.2.8.27
Oracle
Utilities Framework
Version 4.3.0.5.0
Utilities Framework
Version 4.3.0.6.0
Utilities Framework
Version 4.4.0.0.0
Utilities Framework
Version 4.4.0.2.0

Related CWEs

CWE-379
Creation of Temporary File in Directory with Insecure Permissions
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

References (38)

Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Mailing ListVendor Advisory
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.