CVE-2020-11979 log

Severity Medium
Remote No
Type Arbitrary code execution
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Group Package Affected Fixed Severity Status Ticket
AVG-1312 ant 1.10.8-1 1.10.9-1 Medium Fixed
Date Advisory Group Package Severity Type
05 Dec 2020 ASA-202012-5 AVG-1312 ant Medium arbitrary code execution