CVE-2020-11979
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Risk Assessment
A local attacker can inject malicious code into the build process, potentially compromising the resulting application or the build system.
Recommendation
Update Apache Ant to a version containing the fix for this issue (later than 1.10.8). Restrict local access to build systems to trusted users.
Other vulnerabilities in Apache Ant
See all- CVE-2026-78254High
The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18.
- CVE-2021-36374Medium
When reading a specially crafted ZIP archive or derived formats, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.
- CVE-2021-36373Medium
When reading a specially crafted TAR archive, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.
Original NVD description (English source)
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS