CVE-2020-1945

Name of the Vulnerable Software and Affected Versions Apache Ant versions 1.1 through 1.9.14 Apache Ant versions 1.10.0 through 1.10.7

Description The issue is related to the use of the default temporary directory identified by the Java system property java.io.tmpdir for several tasks, which may lead to sensitive information leakage. Specifically, the fixcrlf and replaceregexp tasks copy files from the temporary directory back into the build tree, allowing an attacker to inject modified source files into the build process. This could enable an attacker to modify data or gain unauthorized access to protected information.

Recommendations For Apache Ant versions 1.1 through 1.9.14, update to a version outside of this range to mitigate the risk. For Apache Ant versions 1.10.0 through 1.10.7, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the temporary directory identified by java.io.tmpdir to minimize the risk of exploitation.