NetSight
IP …
high7.5

CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access the…

Impact

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Affected products

VendorProductAffected versions
ApacheAnt
Version 1.10.8
GradleGradle
before 6.8.0
FedoraprojectFedora
Versions 31, 32, 33
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleApi Gateway
Version 11.1.2.4.0
OracleBanking Platform
Versions 2.4.0, 2.4.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0
OracleBanking Treasury Management
Version 14.4
OracleCommunications Unified Inventory Management
Versions 7.4.0, 7.4.1
OracleData Integrator
Versions 12.2.1.3.0, 12.2.1.4.0
OracleEndeca Information Discovery Studio
Version 3.2.0.0
OracleEnterprise Repository
Version 11.1.1.7.0
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.6 through 8.0.9
Versions 8.1.0, 8.1.1

Weakness classification

CWE-379

References