GitHub Advisoryadvisory · Maven

GHSA-f62v-xpxf-3v68 Code injection in Apache Ant

HIGH Published 2021-02-03 Modified 2025-09-27 Official page ↗
Aliases
CVE-2020-11979
Ecosystem
Maven
Packages
org.apache.ant:ant
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-74, CWE-94
Reviewed
2021-02-03

Affected packages

• Maven org.apache.ant:ant: < 1.10.9 → fixed in 1.10.9

Description

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Related

Alias · CVE (1)

  • CVE-2020-11979 As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was… vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References