● CVE — High
CVE-2020-11979
Vendorfedoraproject, oracle, gradle, apacheProductfedora, communications unified inventory management, primavera unifier, financial services analytical applications infrastructure, banking platform, endeca information discovery studio, data integrator, primavera gateway, retail integration bus, flexcube private banking, enterprise repository, retail assortment planning, api gateway, retail advanced inventory planning, agile engineering data management, gradle, retail financial integration, ant, banking treasury management, real-time decision server, retail category management planning & optimization, retail eftlink, retail item planning, retail macro space optimization, retail merchandise financial planningDiscoveredOct 1, 2020UpdatedNov 21, 2024
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.