CVEvulnerability

CVE-2020-11979

7.5 HIGH Published 2020-10-01 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2020-10-01
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-379

Description

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Affected configurations

• apache ant 1.10.8 • gradle gradle (< 6.8.0) • fedoraproject fedora 31 • fedoraproject fedora 32 • fedoraproject fedora 33 • oracle agile engineering data management 6.2.1.0 • oracle api gateway 11.1.2.4.0 • oracle banking platform 2.4.0 • oracle banking platform 2.4.1 • oracle banking platform 2.6.2 • oracle banking platform 2.7.0 • oracle banking platform 2.7.1 • oracle banking platform 2.8.0 • oracle banking treasury management 14.4 • oracle communications unified inventory management 7.4.0 • oracle communications unified inventory management 7.4.1 • oracle data integrator 12.2.1.3.0 • oracle data integrator 12.2.1.4.0 • oracle endeca information discovery studio 3.2.0.0 • oracle enterprise repository 11.1.1.7.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.0.9) • oracle financial services analytical applications infrastructure 8.1.0 • oracle financial services analytical applications infrastructure 8.1.1 • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle primavera gateway (>= 16.2.0 <= 16.2.11) • oracle primavera gateway (>= 17.12.0 <= 17.12.9) • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle primavera unifier 20.12 • oracle real-time decision server 3.2.0.0 • oracle real-time decision server 11.1.1.9.0 • oracle retail advanced inventory planning 14.1 • oracle retail assortment planning 16.0.3 • oracle retail category management planning \& optimization 16.0.3 • oracle retail eftlink 19.0.1 • oracle retail eftlink 20.0.0 • oracle retail financial integration 14.1.3 • oracle retail financial integration 15.0.3 • oracle retail financial integration 16.0.3 • oracle retail integration bus 15.0.3 • oracle retail item planning 16.0.3 • oracle retail macro space optimization 16.0.3 • oracle retail merchandise financial planning 16.0.3 • oracle retail merchandising system 14.1.3.2 • oracle retail merchandising system 16.0.3 • oracle retail predictive application server 14.1 • oracle retail regular price optimization 16.0.3 • oracle retail replenishment optimization 16.0.3 • oracle retail service backbone 14.1.3 • oracle retail service backbone 15.0.3 • oracle retail service backbone 16.0.3 • oracle retail size profile optimization 16.0.3 • oracle retail store inventory management 14.1.3.9 • oracle retail store inventory management 15.0.3.0 • oracle retail store inventory management 16.0.3.0 • oracle retail xstore point of service 15.0.4 … and 11 more

Related

Weakness · CWE (1)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness

References