CVE-2020-11979

Aliases:GHSA-f62v-xpxf-3v68BIT-gradle-2020-11979
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 01 Oct 2020, 19:24
Last modified:04 Aug 2024, 11:48

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
1.1% LOW
1% probability -0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Oct 2020, 19:24
Published
Vulnerability first disclosed
04 Aug 2024, 11:48
Last Modified
Vulnerability information updated

Description

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 1.10%• Percentile: 78%

Techniques & Countermeasures

  • CWE-379•Creation of Temporary File in Directory with Insecure Permissions

    The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Affected Systems

  • apache•ant

    1.10.8

  • fedoraproject•fedora

    31 | 32 | 33

  • gradle•gradle

    < 6.8.0

  • org.apache.ant•ant

    < 1.10.9

  • oracle•agile_engineering_data_management

    6.2.1.0

  • oracle•api_gateway

    11.1.2.4.0

  • oracle•banking_platform

    2.4.0 | 2.4.1 | 2.6.2 | 2.7.0 | 2.7.1 | 2.8.0

  • oracle•banking_treasury_management

    14.4

  • oracle•communications_unified_inventory_management

    7.4.0 | 7.4.1

  • oracle•data_integrator

    12.2.1.3.0 | 12.2.1.4.0

  • oracle•endeca_information_discovery_studio

    3.2.0.0

  • oracle•enterprise_repository

    11.1.1.7.0

  • oracle•financial_services_analytical_applications_infrastructure

    ≥ 8.0.6, ≤ 8.0.9 | 8.1.0 | 8.1.1

  • oracle•flexcube_private_banking

    12.0.0 | 12.1.0

  • oracle•primavera_gateway

    ≥ 16.2.0, ≤ 16.2.11 | ≥ 17.12.0, ≤ 17.12.9

  • oracle•primavera_unifier

    ≥ 17.7, ≤ 17.12 | 16.1 | 16.2 | 18.8 | 19.12 | 20.12

  • oracle•real-time_decision_server

    3.2.0.0 | 11.1.1.9.0

  • oracle•retail_advanced_inventory_planning

    14.1

  • oracle•retail_assortment_planning

    16.0.3

  • oracle•retail_category_management_planning_\&_optimization

    16.0.3

  • oracle•retail_eftlink

    19.0.1 | 20.0.0

  • oracle•retail_financial_integration

    14.1.3 | 15.0.3 | 16.0.3

  • oracle•retail_integration_bus

    15.0.3

  • oracle•retail_item_planning

    16.0.3

  • oracle•retail_macro_space_optimization

    16.0.3

  • oracle•retail_merchandise_financial_planning

    16.0.3

  • oracle•retail_merchandising_system

    14.1.3.2 | 16.0.3

  • oracle•retail_predictive_application_server

    14.1

  • oracle•retail_regular_price_optimization

    16.0.3

  • oracle•retail_replenishment_optimization

    16.0.3

  • oracle•retail_service_backbone

    14.1.3 | 15.0.3 | 16.0.3

  • oracle•retail_size_profile_optimization

    16.0.3

  • oracle•retail_store_inventory_management

    14.1.3.9 | 15.0.3.0 | 16.0.3.0

  • oracle•retail_xstore_point_of_service

    15.0.4 | 16.0.6 | 17.0.4 | 18.0.3 | 19.0.2

  • oracle•storagetek_acsls

    8.5.1

  • oracle•storagetek_tape_analytics

    2.4

  • oracle•timesten_in-memory_database

    < 11.2.2.8.27

  • oracle•utilities_framework

    4.3.0.5.0 | 4.3.0.6.0 | 4.4.0.0.0 | 4.4.0.2.0

References (32)