CVE-2020-11979

Aliases:GHSA-f62v-xpxf-3v68BIT-gradle-2020-11979GHSA-j45w-qrgf-25vmDEBIAN-CVE-2020-11979CGA-22w2-f3jv-ggmpCGA-22wx-3pp8-qgxwCGA-24c7-8r92-f7vjCGA-2gqf-28f2-66mgCGA-2pwx-gp8f-f9g5CGA-2r6f-2vxj-4q82CGA-2x23-w7mm-7xv4CGA-34xw-2jfw-876fCGA-374c-23f7-f4ghCGA-3c9h-q8f9-jjrwCGA-3frj-c8r6-4wq2CGA-3gfw-q52m-4x8pCGA-3x9g-mvrh-8r4fCGA-42ch-fpw3-73q8CGA-43f5-4848-q29fCGA-46j2-c4wj-74g5CGA-4r3q-65jj-vpvhCGA-4v96-vcxw-77r2CGA-5c6q-2xhv-5j46CGA-5jx4-f258-82rgCGA-627j-79mm-gg4cCGA-632w-8w65-jr8vCGA-669h-m337-m8ggCGA-6f6r-v8p7-3355CGA-6hj4-c6mv-gj68CGA-6r2w-9rq4-v8r3CGA-758x-jc5m-c6pjCGA-7f62-g3mj-w54hCGA-7x6r-77c7-gfv7CGA-8835-mxh5-jgqvCGA-8w8m-wh5v-7m3qCGA-8w9w-6jfr-g9wpCGA-92c2-29xc-6g2jCGA-92w7-3gc6-44hjCGA-9f9f-h7c7-qhqxCGA-c57g-f97f-x9ghCGA-c7fw-5ghm-xq5qCGA-c7h5-3g2f-p6vvCGA-cc2f-rq7f-jc86CGA-cm4m-2jw3-g4p3CGA-cqh7-46cm-6238CGA-cr22-w8h6-v99fCGA-cvxh-3c5x-8v45CGA-f2r7-9374-hmm5CGA-f4wf-vh76-cgmhCGA-f5p5-m5jx-wmxrCGA-fh43-qrr5-w2gvCGA-fmh5-qvxc-p4cjCGA-fp7w-jv8r-4pfmCGA-fqmf-jgm5-hh8jCGA-fxvr-m43c-whrxCGA-g46f-hwhh-2fhmCGA-gfrv-79f5-jcgqCGA-gh28-2h22-9723CGA-gjj9-rcx9-75wqCGA-hc4m-mwg6-cxghCGA-hvx7-83fp-3x2jCGA-j2hq-jvg3-q43wCGA-j34r-qpcv-jjq4CGA-j389-v52v-jhf4CGA-jgq5-mx4w-j66pCGA-jj74-4v3h-7wfqCGA-jqfr-xcr7-39g8CGA-jr55-7c9m-cw59CGA-jv2h-w29r-mfp6CGA-m2pf-4x57-4w4pCGA-m3vw-353p-2pj6CGA-m4v6-875q-ww7xCGA-m6gh-gp2g-6rrvCGA-m9w8-7397-q7fcCGA-mrmp-qfm4-5q64CGA-mrwv-2hxq-5g54CGA-p299-vwp4-3wh2CGA-p9x3-frmr-wq37CGA-pfq4-2pw8-mqp3CGA-pfvj-fhhq-prmfCGA-pmwj-rjj2-m3qpCGA-pqcr-54j7-xccmCGA-pwrm-g3c7-2x77CGA-q4w6-xgxx-fc2mCGA-q92f-8qrf-r634CGA-qhvq-48g9-px83CGA-qrmg-m8m3-cv4jCGA-r5v2-fv8m-wwc3CGA-rfj8-gq6j-p4cfCGA-rx8j-39cq-hcr5CGA-v2jr-6pvj-pmpjCGA-v2vf-9279-7vr8CGA-v69q-pvgc-qv4fCGA-vhr2-q563-r8c4CGA-vm7q-xh8g-38hrCGA-vxjh-j6wc-4rh6CGA-w4f3-w9w7-p48hCGA-w87g-gcmw-wj2hCGA-w8pm-wpw6-h83gCGA-wg9c-mgh4-m49pCGA-wh94-2qpr-j778CGA-wpxw-q392-xgjrCGA-wq6q-rr8v-87jfCGA-wvqj-5v3x-9g47CGA-wwrv-9435-gphxCGA-wxh9-77m6-8v2hCGA-x35x-vm4j-g96rCGA-x39g-wqxf-f9j2CGA-x463-76c3-xqx6CGA-x594-88gj-5cqcCGA-xg5w-9mp7-v3p8CGA-xgmq-pfgf-6vm2CGA-xhqm-4344-g5xhCGA-xjq2-whpj-g2r4CGA-xpx2-2h2c-cjc8CGA-xr77-x54g-m5gpCGA-xr8v-8mrr-8q8hCGA-xvjw-mjxm-99qxCGA-237v-w4vj-m69hCGA-2555-45m2-6292CGA-2c2c-vv6p-ch5fCGA-2cfh-vmvf-6wg5CGA-2h5p-73mr-xgxqCGA-2v76-cp85-cq88CGA-2xhg-69fv-w97qCGA-3229-493v-ghjpCGA-333w-fj53-gpfmCGA-37v7-v39x-6x7pCGA-39hf-f8h5-f59pCGA-3cv9-j38f-jprgCGA-3fcx-q9x6-5cxgCGA-3q26-742v-mfqpCGA-42xp-cjp6-8hrxCGA-4755-475c-2c5jCGA-4fh9-x8wh-vwj6CGA-4g2j-p7cf-hxm4CGA-4q9v-c8r5-cfmmCGA-4vxv-625h-j22vCGA-4xpg-44w4-cchcCGA-5337-r99w-jrfpCGA-57hh-h7qv-qcx2CGA-595c-h4v5-x7hgCGA-5cq9-jcc7-xqhcCGA-5hxx-vh2m-j6j3CGA-5mm6-33mm-vjj5CGA-5w77-fjfh-xgc4CGA-62q6-86hw-8fgfCGA-65hm-c4j4-pxhcCGA-6fc6-jv5h-333qCGA-6gc4-444h-4259CGA-72gm-hcqr-cxw9CGA-735h-jc2w-c963CGA-74wh-3x9f-m29pCGA-7752-j2gx-rq72CGA-7fx4-j6j8-5qrgCGA-7qxm-w4ff-m3v3CGA-7r24-vvjq-xm2pCGA-7r5r-2h2v-2r5vCGA-7vcj-cw32-7fp2CGA-84hg-gj7x-r365CGA-857j-3w24-jgj6CGA-8hv7-rqrc-mfj7CGA-987g-p488-2g6hCGA-99r8-6gc8-jhcfCGA-9pm2-8c9g-frw3CGA-c28p-4q52-jpq7CGA-c544-f36f-cwvpCGA-c98m-w28h-3q6cCGA-cw3h-rpp8-h3gqCGA-cx97-3wxh-vh3gCGA-f493-vg2q-wr6gCGA-f836-mrp8-q25vCGA-fg68-37hr-5m99CGA-fgmj-fq29-2653CGA-fh6f-mv6m-73fvCGA-fvgw-q26v-3mp7CGA-g5qh-m8v5-cfg8CGA-g8f5-vm5m-2g8hCGA-gq9w-h96x-8fmmCGA-gxv9-8f25-wp5wCGA-h78c-3wvq-chp5CGA-hhv3-jhr2-jqpxCGA-hv22-wj9c-rxwmCGA-hvr7-3rrw-7v5mCGA-hw3p-9x9m-c349CGA-hwhc-p6wq-f762CGA-j66j-2733-cf9pCGA-j6m3-3r8q-92q5CGA-j8xc-8px3-q28rCGA-jm5p-h856-6fhgCGA-jxcj-3wcj-9x3cCGA-m7rr-j7rq-3cc3CGA-mcg9-p7mh-m466CGA-mfw5-36qr-cc43CGA-mjgf-j94h-cwh4CGA-mjx2-4c8p-5m2xCGA-mmxh-8h37-qwh8CGA-p4qg-rr63-729xCGA-p4wv-h9x4-qh42CGA-p8rv-w2h5-6579CGA-pjr8-6ch7-cqgxCGA-pr6h-mwgh-g399CGA-pr6q-95gx-pr86CGA-px5c-r4v8-wqh6CGA-q3q7-f763-5r64CGA-q4jv-8mpc-5pj4CGA-q694-5pcj-88q5CGA-qhf2-8r33-h2x2CGA-qwvw-r6m4-cj26CGA-r57c-7j56-pfm7CGA-r5f3-7r2m-fqgwCGA-rfmw-r959-h7xvCGA-rghf-w657-j77xCGA-rp23-g2mc-f88vCGA-rw8c-2f2p-q6wcCGA-v2xc-mvx3-fvx5CGA-v7w2-wcrc-mjr2CGA-v8h4-gjv9-5c4rCGA-vfh4-pj69-qvcrCGA-vhm3-prxv-cwjwCGA-vxv7-jc4j-749mCGA-w78m-88cw-gj9xCGA-w84v-4c3v-jhg6CGA-wf62-x74f-27fxCGA-wfmc-x2mh-v55jCGA-x4qq-w588-89vhCGA-x68c-3653-rhg5CGA-x85q-g3p5-cc42CGA-xfww-3xjp-mc2mCGA-xgqw-q64j-vr3mCGA-xhgw-fmrj-r739CGA-xhmf-7mxx-2328CGA-xq3q-jvq6-wchxCGA-xv9g-wwvp-h45mCGA-27g7-cghg-48jrCGA-28p8-3gjr-6mjvCGA-28pr-23vc-mwf7CGA-29f2-j6c3-fphvCGA-29f6-rhpp-39vfCGA-2cxp-mgw4-4m63CGA-2r4g-rxqq-m36jCGA-2vmv-pv2m-g98gCGA-2wm5-vfrw-h7qwCGA-2x5g-mh4h-q2p6CGA-347q-8vfr-8xrxCGA-378r-97xg-vq5mCGA-38rx-hqmm-2rxjCGA-3h9h-c27r-373xCGA-3rc9-73pv-vm6mCGA-3w8j-c24x-rvfhCGA-3x5h-qqh6-jphfCGA-4537-qr4q-grfmCGA-4563-j73c-c4fgCGA-48c6-pp82-6xqpCGA-4gh6-w98h-vwjjCGA-4q2g-v8rw-fxh5CGA-4qv3-cv28-84fmCGA-4rr3-985g-mj34CGA-4rx3-c92f-6274CGA-4xcm-f9pf-78gwCGA-52qc-hc9f-453gCGA-536c-vpr8-r8w2CGA-53qg-pjgf-54g5CGA-54wh-rwp5-mpp3CGA-5673-65hw-pm6mCGA-56r3-4vjq-44rrCGA-5fw9-jwcr-6973CGA-629p-393v-xgfgCGA-6gcj-chf3-3h67CGA-6qf5-jm53-qm8qCGA-6r89-pjrp-2f2cCGA-7369-wqwr-525wCGA-74jg-mwj9-hc2fCGA-7c7j-f5fp-v59fCGA-7j5f-cxcg-8wvjCGA-7mwg-qfhv-f282CGA-7p7x-j6qv-8gjjCGA-82rr-gr34-cwgwCGA-8fj6-qqmj-82m5CGA-8g42-pr59-c467CGA-8gxq-xc2r-2xr2CGA-8jw3-rgpg-92wvCGA-8mcp-m27j-hfq7CGA-8pr9-x3h4-cjrcCGA-975p-pqjx-vq3qCGA-9mq8-hq29-9xp4CGA-9p67-6gp5-92jpCGA-9q6g-7mhv-gpm9CGA-9r83-7gv7-72rcCGA-9xfr-p9j9-f8p3CGA-c44h-fgxw-mfwpCGA-c747-jcv5-4h2mCGA-ccxc-c5m7-4wc5CGA-cfrx-qxv8-vrgcCGA-cgpp-w4wg-jg8rCGA-cqh2-9m3f-xp69CGA-f2v2-8h4x-v9qjCGA-fg2w-g5gw-hqp5CGA-frv5-3rw3-j647CGA-fv5v-64rg-cqh2CGA-fv8h-wp8h-82crCGA-fw48-227j-xq4wCGA-fxxp-pmhr-mhgfCGA-g3mr-3g36-cjrqCGA-g5hm-cxr5-xmh3CGA-gj7h-4m9r-4w45CGA-h34j-hhqv-wpq5CGA-h9j6-wp6r-4x4mCGA-hc55-g7qh-8x2pCGA-hfrj-rc9p-fp7qCGA-hg8j-23w5-7388CGA-hwmh-gpjm-9q2xCGA-hxcg-9cmp-g7h3CGA-j2m9-6cgm-g39cCGA-j7mx-gmfc-cp8gCGA-j7qf-x7cg-63gvCGA-jjh3-x2h5-pf48CGA-jm44-qrq3-x6jrCGA-jr7x-q4jm-2q29CGA-jrg3-2mf6-7crgCGA-m292-93v7-6gprCGA-m29q-fxpf-243vCGA-m3jm-mv43-hjhjCGA-m7x2-43vv-q4c4CGA-m96v-4mw8-g585CGA-mf3m-8mgw-mcx2CGA-mpx6-4jm7-9j5xCGA-mrvc-4w9q-2hc7CGA-mvr6-m537-rw5pCGA-p226-68xw-964mCGA-pf8p-v9vr-vffpCGA-pq43-pvqw-42rhCGA-pqmp-rr4f-c7p6CGA-q3j6-v6p4-9c35CGA-q3mm-3w77-8vpjCGA-q4cp-j84x-fvvvCGA-q53g-88vp-gmrxCGA-qgh8-mrw4-pfhhCGA-qgrf-vfmw-475xCGA-qm25-c2cm-4wrqCGA-qrhj-r4wq-hx53CGA-qw2v-gxfr-x4phCGA-r385-fmjx-mjj3CGA-r7mq-5898-622hCGA-r827-6467-5q9wCGA-rcgq-pq62-qmfcCGA-rf38-72c4-7h8qCGA-rjf9-fr8p-8gj2CGA-rv23-32g8-5hhfCGA-rv93-3hf2-mr9gCGA-rvvq-g75m-8cfwCGA-v2ww-rx44-8946CGA-v5hj-pf3x-v25xCGA-vcjr-5jxg-qh6rCGA-vh8x-jq96-pmrcCGA-vj58-6fr9-38jpCGA-vv53-wh6x-m9jpCGA-vxg6-qwrc-c74gCGA-w289-xh93-62r5CGA-w28h-9j4q-3r3gCGA-w2xw-5jjf-mm8hCGA-w43j-6f5m-x7pjCGA-w536-q6px-cpr8CGA-w6w8-vvqq-x7h9CGA-w79q-pg59-jxp7CGA-w926-3v77-wgpmCGA-wfq6-ccg9-5v7hCGA-wh8f-696r-fj5wCGA-whm2-44r2-w233CGA-whw7-xm43-wcf6CGA-wpfr-84m4-p567CGA-x2r8-rvh6-q29fCGA-xgm9-2xp4-qp96CGA-xh4h-2293-3g3wCGA-xh73-w27x-x647CGA-xpqm-qr92-xg9hCGA-xpvr-29rw-x76cCGA-xq77-c56x-pp35CGA-xq9j-vg5h-ppqxCGA-xvpq-f6x5-c5vcCGA-27p5-cghc-89qmCGA-2rvj-j8x4-57qrCGA-2v7r-6xpw-7wx3CGA-3c9v-wh5c-5362CGA-3g78-4r82-j3qmCGA-3p5w-2mv3-h5vwCGA-3x6r-8359-hrr6CGA-4432-f5pm-3g32CGA-4g47-6fwm-488jCGA-4r4c-vw8c-3q85CGA-53cm-cmcv-xrp8CGA-5586-g97h-73c4CGA-62pg-wp3v-g26mCGA-62q5-9mjq-jwrvCGA-64p5-37jh-7wxpCGA-652j-pq57-g22wCGA-662h-2fvf-4x7wCGA-6mxc-qw4q-wgmfCGA-6pv9-44xr-hx6cCGA-72q5-r2h8-mxr4CGA-75g2-j8q2-37w8CGA-7f39-w8x3-38pfCGA-7gmh-37mm-34q4CGA-7h35-rw74-4p6pCGA-7x55-797f-5jfmCGA-7x5q-r99r-w2vjCGA-86ph-wxw6-95x5CGA-8f9q-7m7j-hmh2CGA-8gw4-469j-v764CGA-8p8p-97x8-cj8wCGA-8ppf-33qw-jqf5CGA-8qqr-v4f8-8476CGA-8qwv-q66r-5672CGA-8rh8-qq8g-x63hCGA-98fv-6fw5-6hjgCGA-9956-h9h9-7qp9CGA-9h3c-mqjw-46mrCGA-9m4v-rh3q-2vfvCGA-9pm2-86fm-r6rvCGA-c3f5-5chr-vj43CGA-c6h4-x2xf-5jfqCGA-c8j9-p929-rwwrCGA-chc3-gx6v-vfpvCGA-cjp8-7wqh-hfmhCGA-f2cm-8gf2-89fvCGA-f9hg-746m-4hv8CGA-f9qv-hwc3-792fCGA-ff8c-2rjj-464vCGA-ffvc-g3xx-mcc3CGA-fg9w-2j4f-vhwhCGA-fgfj-wm92-x5frCGA-fhvr-qc24-c74qCGA-fq9q-cj4g-h3g8CGA-fr9m-v57m-9mqwCGA-frjq-2vw3-8vrvCGA-fv23-2x5x-52xwCGA-g447-jh3c-q578CGA-g747-3cjw-gxcxCGA-g89h-rppp-cm9hCGA-gcxp-7532-3j74CGA-gg7j-ph4h-96grCGA-gq44-p36j-r44pCGA-gwpx-56gq-pm26CGA-h2jv-364x-gx7vCGA-h588-gmq9-qcxrCGA-h7mv-r6g4-4w74CGA-h88p-jrg7-fxvpCGA-hgh2-rg34-g4h5CGA-hrh9-9cq2-6whcCGA-hxj6-r63q-rmpmCGA-hxwr-857c-pr5mCGA-j7x7-wmf4-8hqfCGA-j93m-5p5w-gmcgCGA-jmrr-fh3j-v67gCGA-jq4c-748f-g488CGA-jw4h-hqqq-7h4xCGA-jwfr-rv9c-f4h9CGA-m4cc-xf82-p96rCGA-m7cx-q92q-qcrjCGA-mfpm-8frw-q5hfCGA-mh3j-8qg5-hwqqCGA-mqfj-858x-g8f4CGA-p69j-xx38-gxw5CGA-pf5r-mrrx-j8m4CGA-pg42-q76g-x5w6CGA-pj67-wchf-8f7gCGA-pp54-c4qj-qjwrCGA-px87-7984-jp86CGA-q853-xq5f-xmvwCGA-qcq5-qpwx-xx99CGA-qf32-rww6-fpc3CGA-qfh6-c7cq-hc6hCGA-qjpp-jq3c-2ww2CGA-qpc8-r44f-mpx7CGA-qr54-7p73-35qmCGA-qrx2-8h59-p2j9CGA-r7rr-9fpx-6wpgCGA-r9fm-hfqg-q952CGA-r9hh-9247-8gcxCGA-rqfm-44rw-h783CGA-rqj9-rgvc-cw6fCGA-rr7h-vjx8-vg73CGA-rrj2-w77p-fxf9CGA-rv55-282c-fv6hCGA-v48v-phrj-g2x9CGA-v4mr-7mj8-2v3qCGA-v6j6-q92q-8938CGA-vc6c-gcpc-x5w2CGA-vjvw-v3pc-c45vCGA-vvpg-3f3h-wfq6CGA-vwpv-fmc7-mjh5CGA-vwqw-jx79-crffCGA-vwwx-37f6-p994CGA-w7v4-xvgx-grpgCGA-w9rg-5pm5-cmpcCGA-wv22-5xp2-9xpmCGA-x65m-6q68-q3pvCGA-x6jv-xvvm-pw3fCGA-xm62-cvv5-4w9fCGA-xxvg-8wfj-gw74
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 01 Oct 2020, 19:24
Last modified:04 Aug 2024, 11:48

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
8.02% LOW
8% probability +6.90%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Oct 2020, 19:24
Published
Vulnerability first disclosed
04 Aug 2024, 11:48
Last Modified
Vulnerability information updated

Description

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 8.02%• Percentile: 95%

Techniques & Countermeasures

  • CWE-379•Creation of Temporary File in Directory with Insecure Permissions

    The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Affected Systems

  • apache•ant

    1.10.8

  • chainguard•eco-java-gradle

    all

  • chainguard•eco-java-gradle-1.11

    all

  • chainguard•eco-java-gradle-1.11-default

    all

  • chainguard•eco-java-gradle-2.0

    all

  • chainguard•eco-java-gradle-2.0-default

    all

  • chainguard•eco-java-gradle-2.1

    all

  • chainguard•eco-java-gradle-2.1-default

    all

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.10-default

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.11-default

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.12-default

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.13-default

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14-default

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.14.1-default

    all

  • chainguard•eco-java-gradle-2.2

    all

  • chainguard•eco-java-gradle-2.2-default

    all

  • chainguard•eco-java-gradle-2.2.1

    all

  • chainguard•eco-java-gradle-2.2.1-default

    all

  • chainguard•eco-java-gradle-2.3

    all

  • chainguard•eco-java-gradle-2.3-default

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.4-default

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.5-default

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.6-default

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.7-default

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.8-default

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-2.9-default

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.0-default

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.1-default

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2-default

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.2.1-default

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.3-default

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4-default

    all

Showing first 50 affected entries in server-rendered view.

References (33)