Description
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Ant | Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ant | 1.10.8-1 | — |
| Debian 13 | ant | 1.10.8-1 | — |
| Debian 12 | ant | 1.10.8-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ant | 1.10.7-1ubuntu0.1~esm1 | USN-4874-1 |
| Ubuntu Pro 18.04 LTS | ant | 1.10.5-3~18.04.1~esm1 | USN-4874-1 |
| Ubuntu Pro 16.04 LTS | ant | 1.9.6-1ubuntu1.1+esm1 | USN-4874-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | ant | 1.9.3-2ubuntu0.1+esm1 | USN-4874-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | conmon | 2:2.0.21-1.rhaos4.5.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | jenkins | 2.263.3.1612434332-1.el7 | RHSA-2021:0429, RHSA-2021:0423 |
| Red Hat OpenShift 4 | machine-config-daemon | 4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift +1 | 4.5.0-202102050524.p0.git.0.9229406.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift-ansible +1 | 4.5.0-202102031005.p0.git.0.c6839a2.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.5.0-202102051529.p0.git.3612.61b096a.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | runc | 1.0.0-72.rhaos4.5.giteadfc6b.el8 | RHSA-2021:0429 |
| Red Hat OpenShift 3 | jenkins | 2.263.3.1612433584-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1612862361-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | python-rsa +1 | 4.5-3.el7 | RHSA-2021:0637 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | ant +2 | 1.10.7-4.3.1 | SUSE-SU-2020:1944-1 |
| SLES 12 SP5 | ant | 1.9.4-3.12.1 | SUSE-SU-2022:4022-1 |
| SLES 12 SP5 | ant-antlr | 1.9.4-3.12.3 | SUSE-SU-2022:4022-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | ant | 1.9.4-3.12.1 | SUSE-SU-2022:4022-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ant | 1.10.10-1.2 | openSUSE-SU-2024:10616-1 |
| openSUSE Tumbleweed | junit | 4.13.2-1.1 | openSUSE-SU-2024:11676-1 |
| openSUSE Leap 15.2 | ant +3 | 1.10.7-lp152.2.3.1 | openSUSE-SU-2020:1022-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.23 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.22 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.21 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.20 | apache-ant | 1.10.8-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.18 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.17 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.16 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.15 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.14 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.13 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.12 | apache-ant | 1.10.8-r0 | — |
| Alpine v3.11 | apache-ant | 1.10.8-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.ant:ant | >= 1.1, < 1.9.15 | 1.9.15 | GHSA-4p6w-m9wc-c9c9 |
| Maven | org.apache.ant:ant | >= 1.10.0, < 1.10.8 | 1.10.8 | GHSA-4p6w-m9wc-c9c9 |
Advisories 14
- RHSA-2021:0637 Red Hat Security Advisory: OpenShift Container Platform 3.11.394 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:0429 Red Hat Security Advisory: OpenShift Container Platform 4.5.33 packages and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:0423 Red Hat Security Advisory: OpenShift Container Platform 4.6.17 security and packages update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-4874-1 ant vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- WID-SEC-2024-1637 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- openSUSE-SU-2020:1022-1 Security update for ant SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10616-1 ant-1.10.10-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4022-1 Security update for ant SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1944-1 Security update for ant SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11676-1 junit-4.13.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- NCSC-2024-0298 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jul 17, 2024
References
- [creadur-dev] 20200518 [jira] [Created] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [creadur-commits] 20200518 [creadur-rat] 03/03: RAT-269: Update Apache ANT to fix CVE-2020-1945 mailing-list
- [creadur-commits] 20200518 [creadur-rat] branch master updated: RAT-269: Update Apache ANT to fix CVE-2020-1945 mailing-list
- [creadur-dev] 20200518 [jira] [Closed] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [creadur-dev] 20200518 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [creadur-dev] 20200518 [jira] [Assigned] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [groovy-notifications] 20200522 [jira] [Closed] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability mailing-list
- [hive-dev] 20200530 [jira] [Created] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [hive-issues] 20200530 [jira] [Assigned] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [hive-issues] 20200530 [jira] [Updated] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [hive-issues] 20200530 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- USN-4380-1 vendor-advisory
- FEDORA-2020-52741b0a49 vendor-advisory
- FEDORA-2020-7f07da3fef vendor-advisory
- [hive-issues] 20200621 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [creadur-dev] 20200703 [jira] [Commented] (RAT-269) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E
- [db-torque-dev] 20200715 svn commit: r1879896 - in /db/torque/torque4/trunk: ./ torque-ant-tasks/ torque-ant-tasks/src/test/java/org/apache/torque/ant/task/ torque-generator/src/main/java/org/apache/torque/generator/control/ torque-generator/src/main mailing-list
- openSUSE-SU-2020:1022 vendor-advisory
- GLSA-202007-34 vendor-advisory
- [hive-issues] 20200804 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [myfaces-commits] 20200826 [myfaces-tobago] branch tobago-2.x updated: update ant because of CVE-2020-1945 mailing-list
- [ant-dev] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability mailing-list
- [announce] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability mailing-list
- [ant-user] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability mailing-list
- [creadur-dev] 20200930 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 mailing-list
- [creadur-dev] 20200930 [jira] [Created] (RAT-274) Update to latest Ant in order to fix CVE-2020-11979 mailing-list
- [oss-security] 20200930 [CVE-2020-11979] Apache Ant insecure temporary file vulnerability mailing-list
- [creadur-dev] 20201006 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 mailing-list
- [creadur-dev] 20201006 [jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 mailing-list
- [creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 mailing-list
- [creadur-dev] 20201006 [jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- [creadur-dev] 20201006 [jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [hive-issues] 20201022 [jira] [Commented] (HIVE-23583) Fix CVE-2020-1945: Apache Ant insecure temporary file vulnerability by updating to latest ANT mailing-list
- [groovy-notifications] 20201126 [jira] [Updated] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability mailing-list
- [groovy-notifications] 20201126 [jira] [Comment Edited] (GROOVY-9552) Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability mailing-list
- [groovy-commits] 20201126 [groovy] branch GROOVY_2_4_X updated: GROOVY-9552: Bump Ant versions to address: [CVE-2020-1945] Apache Ant insecure temporary file vulnerability mailing-list
- [groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure mailing-list
- [groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure mailing-list
- [oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosure mailing-list
- [announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure mailing-list
- [groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure mailing-list
- [myfaces-commits] 20201211 [myfaces-tobago] 02/22: update ant because of CVE-2020-1945 mailing-list
- https://www.oracle.com/security-alerts/cpujan2021.html
- [creadur-dev] 20210419 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- [creadur-dev] 20210621 [jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8 mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html