What’s Vulnerable › Vulnerabilities
CVE-2020-1945
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-05-14 · updated 2026-06-17
- Weakness: CWE-668
Description
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
Affected products
- Apache Software Foundation Apache Ant: from 1.1 through 1.9.14; from 1.10.0 through 1.10.7
- Canonical Ubuntu Linux: 19.10
- Fedoraproject Fedora: 31, 32
- openSUSE Leap: 15.2
- Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
- Oracle Banking Enterprise Collections: from 2.7.0 through 2.9.0
- Oracle Corporation Oracle Banking Liquidity Management: from 14.0.0 through 14.4.0
- Oracle Banking Platform: from 2.4.0 through 2.9.0
- Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
- Oracle Category Management Planning & Optimization: 15.0.3
- Oracle Communications Asap: 7.3
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
- Oracle Communications Metasolv Solution: 6.3.0
- Oracle Corporation Oracle Communications Order and Service Management: 7.3, 7.4
- Oracle Corporation Oracle Data Integrator: 12.2.1.3.0, 12.2.1.4.0
- Oracle Endeca Information Discovery Studio: 3.2.0
- Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
- Oracle Corporation Enterprise Repository: 11.1.1.7.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.0
- Oracle Corporation FLEXCUBE Investor Servicing: 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Health Sciences Information Manager: from 3.0 through 3.0.2
- Oracle Corporation Primavera Gateway: from 16.2.0 through 16.2.11; from 17.12.0 through 17.12.7
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
- Oracle Corporation Rapid Planning: 12.1, 12.2
- Oracle Real-Time Decision Server: 3.2.1.0
- Oracle Retail Advanced Inventory Planning: 14.1, 15.0, 16.0
- Oracle Retail Assortment Planning: 15.0.3, 16.0.3
- Oracle Corporation Retail Back Office: 14.0, 14.1
- Oracle Corporation Retail Bulk Data Integration: 15.0, 16.0, 16.0.3.0, 19.0.1
How to fix
Upgrade to a fixed version: Oracle Corporation TimesTen In-Memory Database 11.2.2.8.27. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00053.html
- http://www.openwall.com/lists/oss-security/2020/09/30/6
- http://www.openwall.com/lists/oss-security/2020/12/06/1
- https://lists.apache.org/thread.html/r0d08a96ba9de8aa435f32944e8b2867c368a518d4ff57782e3637335%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r1863b9ce4c3e4b1e5b0c671ad05545ba3eb8399616aa746af5dfe1b1%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r1a9c992d7c8219dc15b4ad448649f0ffdaa88d76ef6a0035c49455f5%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r1b32c76afffcf676e13ed635a3332f3e46e6aaa7722eb3fc7a28f58e%40%3Cdev.hive.apache.org%3E
- https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r2704fb14ce068c64759a986f81d5b5e42ab434fa13d0f444ad52816b%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r3cea0f3da4f6d06d7afb6c0804da8e01773a0f50a09b8d9beb2cda65%40%3Cissues.hive.apache.org%3E
Get alerted when CVE-2020-1945 or the next vulnerability affects your stack