Bugzilla – Bug 1171696
VUL-0: CVE-2020-1945: ant: insecure temporary file vulnerability
Last modified: 2022-12-02 08:02:57 UTC
through oss CVE-2020-1945: Apache Ant insecure temporary file vulnerability Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 Description: Apache Ant uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. Mitigation: Ant users of versions 1.1 to 1.9.14 and 1.10.0 to 1.10.7 should set the java.io.tmpdir system property to point to a directory only readable and writable by the current user prior to running Ant. Users of versions 1.9.15 and 1.10.8 can use the Ant property ant.tmpfile instead. Users of Ant 1.10.8 can rely on Ant protecting the temporary files if the underlying filesystem allows it, but we still recommend using a private temporary directory instead. Credit: This issue was discovered by Mike Salvatore of the Ubuntu Security Team. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1945 http://seclists.org/oss-sec/2020/q2/106
Tracked all codestreams as affected. That are: SLE10-SP3 SLE11 SLE11-SP3 SLE12 SLE15 Additional references at https://security-tracker.debian.org/tracker/CVE-2020-1945
Upstream report: https://ant.apache.org/security.html
Upstream commits: https://github.com/apache/ant/commit/9c1f4d905da59bf446570ac28df5b68a37281f35/ https://github.com/apache/ant/commit/041b058c7bf10a94d56db3ca9dba38cf90ab9943/ https://github.com/apache/ant/commit/a8645a151bc706259fb1789ef587d05482d98612/
Factory submission, update to 1.10.8: https://build.opensuse.org/request/show/805655
* Branch 1.10.x: - Upstream commits: https://github.com/apache/ant/commit/fe7e9617ed54bb4aeae2e79871d022cbfdddbf3d#diff-390a5809047b1da7f04c445473d3245eR379 https://github.com/apache/ant/commit/d591851ae3921172bb825b5a5344afa3de0e28ca https://github.com/apache/ant/commit/041b058c7bf10a94d56db3ca9dba38cf90ab9943 https://github.com/apache/ant/commit/a8645a151bc706259fb1789ef587d05482d98612 https://github.com/apache/ant/commit/926f339ea30362bec8e53bf5924ce803938163b7 - Affected codestreams: SUSE:SLE-15-SP2:Update (1.10.7) * Submitted here: https://build.suse.de/request/show/220718
SUSE-SU-2020:1944-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1171696 CVE References: CVE-2020-1945 Sources used: SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): ant-1.10.7-4.3.1, ant-antlr-1.10.7-4.3.1, ant-junit-1.10.7-4.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1022-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1171696 CVE References: CVE-2020-1945 Sources used: openSUSE Leap 15.2 (src): ant-1.10.7-lp152.2.3.1, ant-antlr-1.10.7-lp152.2.3.1, ant-junit-1.10.7-lp152.2.3.1, ant-junit5-1.10.7-lp152.2.3.1
Still tracked as affected: - SUSE:SLE-11-SP3:Update - SUSE:SLE-12:Update - SUSE:SLE-15:Update
(In reply to Carlos López from comment #9) > Still tracked as affected: > - SUSE:SLE-11-SP3:Update > - SUSE:SLE-12:Update > - SUSE:SLE-15:Update Hi David, gentle reminder about this issue :) SUSE:SLE-15:Update actually doesn't require a fix, it contains LTSS only channels, and CVSS is not LTSS worthy
(In reply to Thomas Leroy from comment #16) > (In reply to Carlos López from comment #9) > > Still tracked as affected: > > - SUSE:SLE-11-SP3:Update > > - SUSE:SLE-12:Update > > - SUSE:SLE-15:Update > > Hi David, gentle reminder about this issue :) > SUSE:SLE-15:Update actually doesn't require a fix, it contains LTSS only > channels, and CVSS is not LTSS worthy Working on this and bsc#1177180 since yesterday as I just landed from vacation :) Thanks for the reminder!
Won't fix for SUSE:SLE-11-SP3:Update. Please use the mitigation available: > The best mitigation against CVE-2020-11979 and CVE-2020-1945 still is to > make Ant use a directory that is only readable and writable by the > current user. > > Ant users of versions 1.10.8 and 1.9.15 can use the Ant property > ant.tmpdir to point to such a directory, users of versions 1.1 to 1.9.14 > and 1.10.0 to 1.10.7 should set the java.io.tmpdir system property.
Thanks! Then it's all done. Sending back to security.
SUSE-SU-2022:4022-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1171696,1177180 CVE References: CVE-2020-11979,CVE-2020-1945 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): ant-1.9.4-3.12.1, ant-antlr-1.9.4-3.12.3 SUSE Linux Enterprise Server 12-SP5 (src): ant-1.9.4-3.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.