CVE-2020-11979
Code injection in Apache Ant
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
CVE-2020-11979- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-379
- Updated
- 2026-11-02
CVE List No score
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
CVE-2020-11979- Weakness
- CWE-379
- Updated
- 2026-11-02
EUVDEUVD-2021-0549 No score
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
EUVD-2021-0549- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f62v-xpxf-3v68
Code injection in Apache Ant
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
GHSA-f62v-xpxf-3v68- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74, CWE-94
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-11979
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
ALPINE-CVE-2020-11979- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2020-11979
CVE-2020-11979 does not affect BellSoft software
- Record
BELL-CVE-2020-11979- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSV
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
CVE-2020-11979- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-11979
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
DEBIAN-CVE-2020-11979- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-f62v-xpxf-3v68
Code injection in Apache Ant
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
GHSA-f62v-xpxf-3v68- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74, CWE-94
- Updated
- 2026-11-02
OSVRHLW-2026-5665ff8f68d7cabb
Lightwell Security Advisory: ant 1.8.2.rhlw-00006
Red Hat Lightwell has released org.apache.ant:ant 1.8.2.rhlw-00006 with backported fixes for CVE-2020-11979 and CVE-2020-1945.
CVE-2020-11979: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
CVE-2020-1945: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
This patched artifact is a drop-in replacement for org.apache.ant:ant 1.8.2 from Maven Central.
- Record
RHLW-2026-5665ff8f68d7cabb- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2021:0423
Red Hat Security Advisory: OpenShift Container Platform 4.6.17 security and packages update
- Record
RHSA-2021:0423- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0429
Red Hat Security Advisory: OpenShift Container Platform 4.5.33 packages and security update
- Record
RHSA-2021:0429- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0637
Red Hat Security Advisory: OpenShift Container Platform 3.11.394 bug fix and security update
- Record
RHSA-2021:0637- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-11979
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
UBUNTU-CVE-2020-11979- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-gradle-2020-11979 No score
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
- Record
BIT-gradle-2020-11979- Updated
- 2026-11-02
OSVMGASA-2021-0173 No score
Updated ant packages fix security vulnerability
Updated ant packages fix security vulnerability:
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process(CVE-2020-11979).
- Record
MGASA-2021-0173- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10616-1 No score
ant-1.10.10-1.2 on GA media
These are all security issues fixed in the ant-1.10.10-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10616-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:4022-1 No score
Security update for ant
This update for ant fixes the following issues:
- CVE-2020-1945: Fixed insecure temporary file vulnerability (bsc#1171696).
- CVE-2020-11979: Fixed issue introduced with fix for CVE-2020-1945 (bsc#1177180).
- Record
SUSE-SU-2022:4022-1- Updated
- 2026-11-02
Affected products
- apache ant
- apache software foundation ant
- fedoraproject fedora
- gradle
- oracle agile engineering data management
- oracle api gateway
- oracle banking platform
- oracle banking treasury management
- oracle communications unified inventory management
- oracle data integrator
- oracle endeca information discovery studio
- oracle enterprise repository
Show 26 moreShow less
- oracle financial services analytical applications infrastructure
- oracle flexcube private banking
- oracle primavera gateway
- oracle primavera unifier
- oracle real-time decision server
- oracle retail advanced inventory planning
- oracle retail assortment planning
- oracle retail category management planning \& optimization
- oracle retail eftlink
- oracle retail financial integration
- oracle retail integration bus
- oracle retail item planning
- oracle retail macro space optimization
- oracle retail merchandise financial planning
- oracle retail merchandising system
- oracle retail predictive application server
- oracle retail regular price optimization
- oracle retail replenishment optimization
- oracle retail service backbone
- oracle retail size profile optimization
- oracle retail store inventory management
- oracle retail xstore point of service
- oracle storagetek acsls
- oracle storagetek tape analytics
- oracle timesten in-memory database
- oracle utilities framework
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.ant:antMaven |
before 1.10.9 | 1.10.9 |
apache-antAlpine:v3.11 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.12 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.13 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.14 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.15 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.16 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.17 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.18 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.19 |
before 1.10.9-r0 | 1.10.9-r0 |
Show 54 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache-antAlpine:v3.20 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.21 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.22 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.23 |
before 1.10.9-r0 | 1.10.9-r0 |
apache-antAlpine:v3.24 |
before 1.10.9-r0 | 1.10.9-r0 |
gradleAlpine:v3.14 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.15 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.16 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.17 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.18 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.19 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.20 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.21 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.22 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.23 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleAlpine:v3.24 |
before 6.8.3-r0 | 6.8.3-r0 |
gradleBitnami |
before 6.8.0 | 6.8.0 |
antDebian:12 |
before 1.10.9-1 | 1.10.9-1 |
antDebian:13 |
before 1.10.9-1 | 1.10.9-1 |
antDebian:14 |
before 1.10.9-1 | 1.10.9-1 |
org.apache.ant:antMaven |
before 1.10.9, plus listed versions 1.10.01.10.11.10.21.10.31.10.4 Show 28 moreShow less1.10.51.10.61.10.71.10.81.7.01.7.11.8.01.8.11.8.21.8.31.8.41.9.01.9.11.9.101.9.111.9.121.9.131.9.141.9.151.9.161.9.21.9.31.9.41.9.51.9.61.9.71.9.81.9.9 |
1.10.9 |
antMageia:7 |
before 1.10.9-1.mga7 | 1.10.9-1.mga7 |
org.apache.ant:antRed Hat Lightwell:Maven |
before 1.8.2.rhlw-00006, plus listed versions 1.7.01.7.11.8.01.8.11.8.2 |
1.8.2.rhlw-00006 |
jenkinsRed Hat:openshift:4.6::el8 |
before 0:2.263.3.1612434510-1.el8 | 0:2.263.3.1612434510-1.el8 |
conmonRed Hat:openshift:4.5::el7 |
before 2:2.0.21-1.rhaos4.5.el7 | 2:2.0.21-1.rhaos4.5.el7 |
jenkinsRed Hat:openshift:4.5::el7 |
before 0:2.263.3.1612434332-1.el7 | 0:2.263.3.1612434332-1.el7 |
openshiftRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202102050524.p0.git.0.9229406.el7 | 0:4.5.0-202102050524.p0.git.0.9229406.el7 |
openshift-ansibleRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202102031005.p0.git.0.c6839a2.el7 | 0:4.5.0-202102031005.p0.git.0.c6839a2.el7 |
openshift-ansible-testRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202102031005.p0.git.0.c6839a2.el7 | 0:4.5.0-202102031005.p0.git.0.c6839a2.el7 |
openshift-clientsRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202102051529.p0.git.3612.61b096a.el7 | 0:4.5.0-202102051529.p0.git.3612.61b096a.el7 |
openshift-clients-redistributableRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202102051529.p0.git.3612.61b096a.el7 | 0:4.5.0-202102051529.p0.git.3612.61b096a.el7 |
openshift-hyperkubeRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202102050524.p0.git.0.9229406.el7 | 0:4.5.0-202102050524.p0.git.0.9229406.el7 |
conmonRed Hat:openshift:4.5::el8 |
before 2:2.0.21-1.rhaos4.5.el8 | 2:2.0.21-1.rhaos4.5.el8 |
machine-config-daemonRed Hat:openshift:4.5::el8 |
before 0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 | 0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 |
openshiftRed Hat:openshift:4.5::el8 |
before 0:4.5.0-202102050524.p0.git.0.9229406.el8 | 0:4.5.0-202102050524.p0.git.0.9229406.el8 |
openshift-clientsRed Hat:openshift:4.5::el8 |
before 0:4.5.0-202102051529.p0.git.3612.61b096a.el8 | 0:4.5.0-202102051529.p0.git.3612.61b096a.el8 |
openshift-clients-redistributableRed Hat:openshift:4.5::el8 |
before 0:4.5.0-202102051529.p0.git.3612.61b096a.el8 | 0:4.5.0-202102051529.p0.git.3612.61b096a.el8 |
openshift-hyperkubeRed Hat:openshift:4.5::el8 |
before 0:4.5.0-202102050524.p0.git.0.9229406.el8 | 0:4.5.0-202102050524.p0.git.0.9229406.el8 |
runcRed Hat:openshift:4.5::el8 |
before 0:1.0.0-72.rhaos4.5.giteadfc6b.el8 | 0:1.0.0-72.rhaos4.5.giteadfc6b.el8 |
runc-debuginfoRed Hat:openshift:4.5::el8 |
before 0:1.0.0-72.rhaos4.5.giteadfc6b.el8 | 0:1.0.0-72.rhaos4.5.giteadfc6b.el8 |
runc-debugsourceRed Hat:openshift:4.5::el8 |
before 0:1.0.0-72.rhaos4.5.giteadfc6b.el8 | 0:1.0.0-72.rhaos4.5.giteadfc6b.el8 |
jenkinsRed Hat:openshift:3.11::el7 |
before 0:2.263.3.1612433584-1.el7 | 0:2.263.3.1612433584-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 |
before 0:3.11.1612862361-1.el7 | 0:3.11.1612862361-1.el7 |
python-rsaRed Hat:openshift:3.11::el7 |
before 0:4.5-3.el7 | 0:4.5-3.el7 |
python2-rsaRed Hat:openshift:3.11::el7 |
before 0:4.5-3.el7 | 0:4.5-3.el7 |
antSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.9.4-3.12.1 | 1.9.4-3.12.1 |
ant-antlrSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.9.4-3.12.3 | 1.9.4-3.12.3 |
antSUSE:Linux Enterprise Server 12 SP5 |
before 1.9.4-3.12.1 | 1.9.4-3.12.1 |
antSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.9.4-3.12.1 | 1.9.4-3.12.1 |
antUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.9.2-11.9.3-11.9.3-21.9.3-2build11.9.3-2ubuntu0.11.9.3-2ubuntu0.1+esm1 |
None known |
antUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.9.6-1ubuntu11.9.6-1ubuntu1.11.9.6-1ubuntu1.1+esm1 |
None known |
antUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.9.9-41.9.9-51.9.9-61.9.10-11.9.10-2 Show 4 moreShow less1.10.3-11.10.3-1ubuntu0.11.10.5-3~18.041.10.5-3~18.04.1~esm1 |
None known |
antUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.10.6-11.10.7-11.10.7-1ubuntu0.1~esm1 |
None known |
antopenSUSE:Tumbleweed |
before 1.10.10-1.2 | 1.10.10-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11979 is a high vulnerability (CVSS 7.5) in Apache Ant, published October 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.76%, the 94th percentile. Fixed in org.apache.ant:ant 1.10.9.
References
lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E
Show 174 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB
security.gentoo.org/glsa/202011-18
oracle.com/security-alerts/cpujan2021.html
github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm
nvd.nist.gov/vuln/detail/CVE-2020-11979
security.alpinelinux.org/vuln/CVE-2020-11979
docs.bell-sw.com/security/cves/CVE-2020-11979
security-tracker.debian.org/tracker/CVE-2020-11979
advisories.mageia.org/MGASA-2021-0173.html
bugs.mageia.org/show_bug.cgi?id=27386
openwall.com/lists/oss-security/2020/09/30/6
ant.apache.org/security.html
access.redhat.com/errata/RHSA-2021:0423
bugzilla.redhat.com/show_bug.cgi?id=1837444
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0423.json
cve.org/CVERecord?id=CVE-2020-1945
jenkins.io/security/advisory/2021-01-26
suse.com/support/update/announcement/2022/suse-su-20224022-1
bugzilla.suse.com/1171696
ubuntu.com/security/CVE-2020-11979