CVE-2020-11979: Code injection in Apache Ant
Summary
CVE-2020-11979: Code injection in Apache Ant. Affects org.apache.ant:ant versions >= 1.10.8, < 1.10.9. Fixed in 1.10.9. How to fix ↓
Also tracked for
The same CVE-2020-11979 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ant is a Java-based build tool used for automating software build processes. It provides a set of tasks and libraries to compile, package, and deploy applications. The vulnerability identified as CVE-2020-11979 allows for code injection in Apache Ant, potentially leading to unauthorized access and manipulation of source files during the build process.
Vulnerability Detail
The vulnerability arises from a flaw in the fixcrlf task of Apache Ant version 1.10.8. In an attempt to mitigate a previous vulnerability (CVE-2020-1945), the permissions of temporary files created by Ant were restricted to the current user. However, the fixcrlf task inadvertently deleted the temporary file and created a new one without the necessary protection. This oversight enables an attacker to inject modified source files into the build process, potentially compromising the integrity and security of the software being built.
How To Fix
Minimum fixed version
1.10.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually apply access restrictions to the temporary files created by the fixcrlf task. This can be done by modifying the permissions of the temporary files to restrict access to only the current user. However, this workaround is not recommended as it requires manual intervention and may not provide complete protection against code injection attacks.
Conclusion
The code injection vulnerability (CVE-2020-11979) in Apache Ant can be mitigated by upgrading to version 1.10.9 or later. It is crucial to promptly address this vulnerability to prevent unauthorized access and manipulation of source files during the build process. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ant:ant →
FAQ
Apache Ant is a Java-based build tool used for automating software build processes. It provides a set of tasks and libraries to compile, package, and deploy applications.
CVE-2020-11979 is a vulnerability in Apache Ant that allows for code injection during the build process. It arises from a flaw in the fixcrlf task of Apache Ant version 1.10.8.
This vulnerability allows an attacker to inject modified source files into the build process, potentially compromising the integrity and security of the software being built.
To fix this vulnerability, it is recommended to upgrade to Apache Ant version 1.10.9 or later.
A temporary workaround is to manually apply access restrictions to the temporary files created by the fixcrlf task. However, this workaround is not recommended as it may not provide complete protection against code injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ant:ant.
