What’s Vulnerable › Vulnerabilities
CVE-2020-11979
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 7.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-10-01 · updated 2026-10-08
- Weakness: CWE-379
Description
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Affected products
- Apache Software Foundation Apache Ant: 1.10.8
- Fedoraproject Fedora: 31, 32, 33
- gradle: before 6.8.0 — fixed in 6.8.0
- Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
- Oracle Corporation API Gateway: 11.1.2.4.0
- Oracle Banking Platform: 2.4.0, 2.4.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0
- Oracle Corporation Banking Treasury Management: 14.4
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.0, 7.4.1
- Oracle Corporation Oracle Data Integrator: 12.2.1.3.0, 12.2.1.4.0
- Oracle Endeca Information Discovery Studio: 3.2.0.0
- Oracle Corporation Enterprise Repository: 11.1.1.7.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.0.9; 8.1.0, 8.1.1
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Primavera Gateway: from 16.2.0 through 16.2.11; from 17.12.0 through 17.12.9
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12, 20.12
- Oracle Real-Time Decision Server: 3.2.0.0, 11.1.1.9.0
- Oracle Retail Advanced Inventory Planning: 14.1
- Oracle Retail Assortment Planning: 16.0.3
- Oracle Retail Category Management Planning & Optimization: 16.0.3
- Oracle Corporation Oracle Retail EFTLink: 19.0.1, 20.0.0
- Oracle Retail Financial Integration: 14.1.3, 15.0.3, 16.0.3
- Oracle Corporation Oracle Retail Integration Bus: 15.0.3
- Oracle Retail Item Planning: 16.0.3
- Oracle Retail Macro Space Optimization: 16.0.3
- Oracle Retail Merchandise Financial Planning: 16.0.3
- Oracle Corporation Retail Merchandising System: 14.1.3.2, 16.0.3
- Oracle Retail Predictive Application Server: 14.1
- Oracle Retail Regular Price Optimization: 16.0.3
- Oracle Retail Replenishment Optimization: 16.0.3
- Oracle Retail Service Backbone: 14.1.3, 15.0.3, 16.0.3
How to fix
Upgrade to a fixed version: gradle 6.8.0; Oracle Corporation TimesTen In-Memory Database 11.2.2.8.27. Check the vendor advisory for mitigations.
References
- https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm
- https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/
Get alerted when CVE-2020-11979 or the next vulnerability affects your stack