Back to CVE records
High 7.5Published Oct 1, 2020
CVE-2020-11979As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.
Updated under an hour ago ()
Does this affect you?
It affects apache ant and 36 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-379
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
apache ant apache:ant | 1.10.8 | NVD |
gradle gradle gradle:gradle | before 6.8.0 | NVD |
fedoraproject fedora fedoraproject:fedora | 31; 32; 33 | NVD |
oracle agile_engineering_data_management oracle:agile_engineering_data_management | 6.2.1.0 | NVD |
oracle api_gateway oracle:api_gateway | 11.1.2.4.0 | NVD |
oracle banking_platform oracle:banking_platform | 2.4.0; 2.4.1; 2.6.2; 2.7.0; 2.7.1; 2.8.0 | NVD |
oracle banking_treasury_management oracle:banking_treasury_management | 14.4 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.4.0; 7.4.1 | NVD |
oracle data_integrator oracle:data_integrator | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle endeca_information_discovery_studio oracle:endeca_information_discovery_studio | 3.2.0.0 | NVD |
oracle enterprise_repository oracle:enterprise_repository | 11.1.1.7.0 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 8.0.6 through 8.0.9; 8.1.0; 8.1.1 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 12.0.0; 12.1.0 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 16.2.0 through 16.2.11; from 17.12.0 through 17.12.9 | NVD |
oracle primavera_unifier oracle:primavera_unifier | from 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12; 20.12 | NVD |
oracle real-time_decision_server oracle:real-time_decision_server | 3.2.0.0; 11.1.1.9.0 | NVD |
oracle retail_advanced_inventory_planning oracle:retail_advanced_inventory_planning | 14.1 | NVD |
oracle retail_assortment_planning oracle:retail_assortment_planning | 16.0.3 | NVD |
oracle retail_category_management_planning_&_optimization oracle:retail_category_management_planning_&_optimization | 16.0.3 | NVD |
oracle retail_eftlink oracle:retail_eftlink | 19.0.1; 20.0.0 | NVD |
oracle retail_financial_integration oracle:retail_financial_integration | 14.1.3; 15.0.3; 16.0.3 | NVD |
oracle retail_integration_bus oracle:retail_integration_bus | 15.0.3 | NVD |
oracle retail_item_planning oracle:retail_item_planning | 16.0.3 | NVD |
oracle retail_macro_space_optimization oracle:retail_macro_space_optimization | 16.0.3 | NVD |
oracle retail_merchandise_financial_planning oracle:retail_merchandise_financial_planning | 16.0.3 | NVD |
oracle retail_merchandising_system oracle:retail_merchandising_system | 14.1.3.2; 16.0.3 | NVD |
oracle retail_predictive_application_server oracle:retail_predictive_application_server | 14.1 | NVD |
oracle retail_regular_price_optimization oracle:retail_regular_price_optimization | 16.0.3 | NVD |
oracle retail_replenishment_optimization oracle:retail_replenishment_optimization | 16.0.3 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 14.1.3; 15.0.3; 16.0.3 | NVD |
oracle retail_size_profile_optimization oracle:retail_size_profile_optimization | 16.0.3 | NVD |
oracle retail_store_inventory_management oracle:retail_store_inventory_management | 14.1.3.9; 15.0.3.0; 16.0.3.0 | NVD |
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service | 15.0.4; 16.0.6; 17.0.4; 18.0.3; 19.0.2 | NVD |
oracle storagetek_acsls oracle:storagetek_acsls | 8.5.1 | NVD |
oracle storagetek_tape_analytics oracle:storagetek_tape_analytics | 2.4 | NVD |
oracle timesten_in-memory_database oracle:timesten_in-memory_database | before 11.2.2.8.27 | NVD |
oracle utilities_framework oracle:utilities_framework | 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0 | NVD |
References
- https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3Ex-refsource-misc
- https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/vendor-advisory, x-refsource-fedora
- https://security.gentoo.org/glsa/202011-18vendor-advisory, x-refsource-gentoo
- https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc
- https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vmx-refsource-misc
- https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpuApr2021.htmlx-refsource-misc
- https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com//security-alerts/cpujul2021.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.