https://bugzilla.redhat.com/show_bug.cgi?id=1903702
Bug ID: 1903702
Summary: CVE-2020-11979 ant: insecure temporary file
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aboyko(a)redhat.com,
aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, aos-bugs(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eleandro(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, gvarsami(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
jaromir.capik(a)email.cz, java-maint(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jburrell(a)redhat.com,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, mizdebsk(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msrb(a)redhat.com, msvehla(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pbhattac(a)redhat.com, pcheung(a)redhat.com,
pdrozd(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
smaestri(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com, sthorger(a)redhat.com,
swoodman(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com, vbobade(a)redhat.com,
vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of
temporary files it created so that only the current user was allowed to access
them. Unfortunately the fixcrlf task deleted the temporary file and created a
new one without said protection, effectively nullifying the effort. This would
still allow an attacker to inject modified source files into the build process.
References:
https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef5...
https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d...
https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8...
https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e7...
https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a...
https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo...
https://security.gentoo.org/glsa/202011-18
--
You are receiving this mail because:
You are on the CC list for the bug.