תיאור (מקור, אנגלית)
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
מוצרים מושפעים
apache: ant; gradle: gradle; fedoraproject: fedora; oracle: agile engineering data management; oracle: api gateway; oracle: banking platform; oracle: banking treasury management; oracle: communications unified inventory management; oracle: data integrator; oracle: endeca information discovery studio; oracle: enterprise repository; oracle: financial services analytical applications infrastructure; oracle: flexcube private banking; oracle: primavera gateway; oracle: primavera unifier
קישורים10
- lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7… Mailing ListVendor Advisory
- lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7… Mailing ListVendor Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
מדדים
- CVSS 3.1
-
7.5
HIGH
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS — סבירות ניצול
- 8% אחוזון 95 · נכון ל-11 בנובמבר 2026
- CWE
- CWE-379
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.