NetSight
IP …
medium6.3

CVE-2020-1945

Sensitive Data Exposure in Apache Ant

Impact

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.ant:ant>= 1.1, < 1.9.151.9.15

Affected products

VendorProductAffected versions
ApacheAnt
from 1.1 through 1.9.14
from 1.10.0 through 1.10.7
CanonicalUbuntu Linux
Version 19.10
FedoraprojectFedora
Versions 31, 32
OpensuseLeap
Version 15.2
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleBanking Enterprise Collections
from 2.7.0 through 2.9.0
OracleBanking Liquidity Management
from 14.0.0 through 14.4.0
OracleBanking Platform
from 2.4.0 through 2.9.0
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCategory Management Planning \& Optimization
Version 15.0.3
OracleCommunications Asap
Version 7.3
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2

Weakness classification

CWE-668CWE-200

References