As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache-antUpgrade gradle | Aug 22, 2024 | Oct 1, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 1, 2020 |
| Debian | — | Upgrade ant | Jul 30, 2024 | Oct 1, 2020 |
| Gentoo Linux | — | Upgrade dev-java/ant. | Nov 17, 2020 | Oct 1, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ant-libUpgrade ant | Feb 2, 2021 | Oct 1, 2020 |
| Oracle Solaris | — | Upgrade developer/build/ant to version 1.10.9-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Oct 1, 2020 |
| Redhat Openshift | — | Upgrade openshiftUpgrade openshift-clientsUpgrade conmonUpgrade machine-config-daemonUpgrade jenkinsUpgrade openshift-ansibleUpgrade runc | Feb 18, 2021 | Oct 1, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 1, 2020 |
| Suse | — | Upgrade ant-jmfUpgrade antlr-bootstrapUpgrade maven-antrun-plugin-javadocUpgrade ant-contrib-manualUpgrade jsch-agent-proxy-pageantUpgrade plexus-ant-factoryUpgrade ant-apache-resolverUpgrade maven-script-antUpgrade ant-xzUpgrade ant-junit5Upgrade ant-apache-oroUpgrade antlr3-javaUpgrade ant-manualUpgrade maven-antrun-pluginUpgrade ant-swingUpgrade ant-contribUpgrade ant-jdependUpgrade maven-plugin-tools-antUpgrade ant-apache-bcelUpgrade jetty-antUpgrade ant-antlrUpgrade antlr3-java-javadocUpgrade antlr4-javaUpgrade ant-contrib-javadocUpgrade antlr3-toolUpgrade antlr3-javadocUpgrade ant-testutilUpgrade plexus-ant-factory-javadocUpgrade antlr4-javadocUpgrade ant-commons-loggingUpgrade ant-javadocUpgrade ant-apache-regexpUpgrade ant-scalaUpgrade antlr-develUpgrade antlr-javaUpgrade ant-jschUpgrade libantlr4-runtime-develUpgrade antlr4-maven-pluginUpgrade antUpgrade ant-scriptsUpgrade groovy-antUpgrade antlr4-toolUpgrade ant-javamailUpgrade ant-apache-bsfUpgrade antlr-manualUpgrade ant-imageioUpgrade antlr3-bootstrap-toolUpgrade ant-junitUpgrade ant-apache-log4jUpgrade ant-commons-netUpgrade ant-apache-xalan2Upgrade antlrUpgrade paranamer-ant | Aug 9, 2024 | Oct 1, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 1, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub