CVE-2020-11979

Опубликовано: 01 окт. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:ant:1.10.8:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*

Версия до 6.8.0 (исключая)

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_treasury_management:14.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*

Версия от 8.0.6 (включая) до 8.0.9 (включая)

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 16.2.0 (включая) до 16.2.11 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 17.12.0 (включая) до 17.12.9 (включая)

cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*

Версия от 17.7 (включая) до 17.12 (включая)

cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*

cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_category_management_planning_\&_optimization:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:14.1.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:15.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_item_planning:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_macro_space_optimization:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandise_financial_planning:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_regular_price_optimization:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_replenishment_optimization:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:14.1.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:15.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:storagetek_tape_analytics:2.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*

Версия до 11.2.2.8.27 (исключая)

cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.0112

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-379

NVD-CWE-Other

Связанные уязвимости

CVE-2020-11979

CVSS3: 7.5

ubuntu

больше 5 лет назад

CVE-2020-11979

CVSS3: 6.2

redhat

больше 5 лет назад

CVE-2020-11979

CVSS3: 7.5

msrc

больше 5 лет назад

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

CVE-2020-11979

CVSS3: 7.5

debian

больше 5 лет назад

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissi ...

GHSA-f62v-xpxf-3v68

CVSS3: 7.5

github

около 5 лет назад

Code injection in Apache Ant

EPSS

Процентиль: 78%

0.0112

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-379

NVD-CWE-Other