Description
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Ant | Apache Ant 1.10.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ant | 1.10.9-1 | — |
| Debian 13 | ant | 1.10.9-1 | — |
| Debian 12 | ant | 1.10.9-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ant | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ant | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ant | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | ant | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | conmon | 2:2.0.21-1.rhaos4.5.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | jenkins | 2.263.3.1612434332-1.el7 | RHSA-2021:0429, RHSA-2021:0423 |
| Red Hat OpenShift 4 | machine-config-daemon | 4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift +1 | 4.5.0-202102050524.p0.git.0.9229406.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift-ansible +1 | 4.5.0-202102031005.p0.git.0.c6839a2.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.5.0-202102051529.p0.git.3612.61b096a.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | runc | 1.0.0-72.rhaos4.5.giteadfc6b.el8 | RHSA-2021:0429 |
| Red Hat OpenShift 3 | jenkins | 2.263.3.1612433584-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1612862361-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | python-rsa +1 | 4.5-3.el7 | RHSA-2021:0637 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | ant | 1.9.4-3.12.1 | SUSE-SU-2022:4022-1 |
| SLES 12 SP5 | ant-antlr | 1.9.4-3.12.3 | SUSE-SU-2022:4022-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | ant | 1.9.4-3.12.1 | SUSE-SU-2022:4022-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ant | 1.10.10-1.2 | openSUSE-SU-2024:10616-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.24 | gradle | 6.8.3-r0 | — |
| Alpine v3.23 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.23 | gradle | 6.8.3-r0 | — |
| Alpine v3.22 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.22 | gradle | 6.8.3-r0 | — |
| Alpine v3.21 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.21 | gradle | 6.8.3-r0 | — |
| Alpine v3.20 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.20 | gradle | 6.8.3-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.19 | gradle | 6.8.3-r0 | — |
| Alpine v3.18 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.18 | gradle | 6.8.3-r0 | — |
| Alpine v3.17 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.17 | gradle | 6.8.3-r0 | — |
| Alpine v3.16 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.16 | gradle | 6.8.3-r0 | — |
| Alpine v3.15 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.15 | gradle | 6.8.3-r0 | — |
| Alpine v3.14 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.14 | gradle | 6.8.3-r0 | — |
| Alpine v3.13 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.12 | apache-ant | 1.10.9-r0 | — |
| Alpine v3.11 | apache-ant | 1.10.9-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.ant:ant | < 1.10.9 | 1.10.9 | GHSA-f62v-xpxf-3v68 |
Advisories 9
- RHSA-2021:0429 Red Hat Security Advisory: OpenShift Container Platform 4.5.33 packages and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:0637 Red Hat Security Advisory: OpenShift Container Platform 3.11.394 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:0423 Red Hat Security Advisory: OpenShift Container Platform 4.6.17 security and packages update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- openSUSE-SU-2024:10616-1 ant-1.10.10-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4022-1 Security update for ant SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- NCSC-2025-0064 Kwetsbaarheden verholpen in IBM Cognos Controller NCSC-NL (Netherlands) · Feb 21, 2025
- WID-SEC-2023-0119 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
References
- https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E
- [creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 mailing-list
- [creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 mailing-list
- [creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 mailing-list
- [creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- [creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- FEDORA-2020-2640aa4e19 vendor-advisory
- FEDORA-2020-92b1d001b3 vendor-advisory
- FEDORA-2020-3ce0f55bc5 vendor-advisory
- GLSA-202011-18 vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm
- [creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- [creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html