Apache Ant Vulnerability CVE-2020-11979: Temporary File Permission Flaw
Summary
CVE-2020-11979: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Affects ant across 2 version ranges.
< 1.10.9-1
< b7e82460c5373e194fb478a998c4fcfe7da53a7e
Fixed in 1.10.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ant is a widely used Java-based build tool that automates software build processes. It allows developers to define build tasks in XML format, making it easier to manage complex builds. The tool is integral to many Java projects, providing functionalities such as compiling code, packaging binaries, and running tests. However, a vulnerability was identified in version 1.10.8, which affects the security of temporary files created during the build process.
Vulnerability Detail
CVE-2020-11979 arises from a flaw in the fixcrlf task of Apache Ant, where temporary files created during the build process do not maintain the necessary permissions. Although the initial fix for CVE-2020-1945 restricted access to these temporary files, the subsequent creation of new files without proper permissions allows attackers to inject malicious source files into the build process. This vulnerability can lead to unauthorized code execution and compromise the integrity of the build.
How To Fix
Minimum fixed version
1.10.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade antTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can manually set permissions on the temporary files created by the fixcrlf task. This can be done by adding a script to change the permissions immediately after the task runs. For example, you can add the following command in your build script:
chmod 600 /path/to/temp/file
Conclusion
CVE-2020-11979 presents a significant security risk for users of Apache Ant, particularly those using versions prior to 1.10.9. It is crucial for developers to upgrade their installations to mitigate the risk of unauthorized code execution through compromised temporary files. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ant →
FAQ
CVE-2020-11979 is a vulnerability in Apache Ant that allows unauthorized access to temporary files created during the build process, potentially leading to code injection.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Apache Ant versions prior to 1.10.9 are affected by this vulnerability. It is recommended to upgrade to version 1.10.9 or later.
If exploited, this vulnerability could allow attackers to inject malicious code into the build process, leading to unauthorized code execution and potential system compromise.
The CVSS score for CVE-2020-11979 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ant.
