Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for

Summary

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Timeline

1. May 14, 2020, 3:57 PM UTCCVE published
2. Aug 4, 2024, 6:54 AM UTCRecord last updated

Affected versions

• n/a Apache Ant

  Version range not reported

• org.apache.ant:antMaven

  From 1.1 · fixed in 1.9.15

• org.apache.ant:antMaven

  From 1.10.0 · fixed in 1.10.8

References 25