NVD脆弱性詳細

CVE-2020-11979

概要	As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
公表日	2020年10月2日5:15
登録日	2021年1月26日10:40
最終更新日	2024年11月21日13:59

CVSS3.1 : HIGH
スコア	7.5
ベクター	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	なし
完全性への影響(I)	高
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
スコア	5.0
ベクター	AV:N/AC:L/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:a:apache:ant:1.10.8:::::::*

構成2		以上	以下	より上	未満
cpe:2.3:a:gradle:gradle::::::::					6.8.0

構成3	以上	以下	より上	未満
cpe:2.3:o:fedoraproject:fedora:31:::::::*
cpe:2.3:o:fedoraproject:fedora:32:::::::*
cpe:2.3:o:fedoraproject:fedora:33:::::::*

構成4	以上	以下	より上	未満
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:16.2:::::::*
cpe:2.3:a:oracle:banking_platform:2.4.0:::::::*
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:::::::*
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:::::::*
cpe:2.3:a:oracle:banking_platform:2.4.1:::::::*
cpe:2.3:a:oracle:primavera_unifier:16.1:::::::*
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:14.1:::::::*
cpe:2.3:a:oracle:banking_platform:2.6.2:::::::*
cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:::::::*
cpe:2.3:a:oracle:primavera_unifier::::::::	17.7	17.12
cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:::::::*
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:::::::*
cpe:2.3:a:oracle:banking_platform:2.7.0:::::::*
cpe:2.3:a:oracle:banking_platform:2.7.1:::::::*
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:::::::*
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	16.2.0	16.2.11
cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.9:::::::*
cpe:2.3:a:oracle:retail_service_backbone:15.0.3:::::::*
cpe:2.3:a:oracle:retail_service_backbone:16.0.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:15.0.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:16.0.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:14.1.3:::::::*
cpe:2.3:a:oracle:retail_service_backbone:14.1.3:::::::*
cpe:2.3:a:oracle:retail_integration_bus:15.0.3:::::::*
cpe:2.3:a:oracle:banking_platform:2.8.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:20.12:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	17.12.0	17.12.9
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:::::::*
cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:::::::*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:::::::*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:::::::*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure::::::::	8.0.6	8.0.9
cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:::::::*
cpe:2.3:a:oracle:retail_eftlink:19.0.1:::::::*
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:::::::*
cpe:2.3:a:oracle:retail_eftlink:20.0.0:::::::*
cpe:2.3:a:oracle:banking_treasury_management:14.4:::::::*
cpe:2.3:a:oracle:retail_regular_price_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:::::::*
cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_replenishment_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_merchandise_financial_planning:16.0.3:::::::*
cpe:2.3:a:oracle:retail_macro_space_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_item_planning:16.0.3:::::::*
cpe:2.3:a:oracle:retail_category_management_planning_\&_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_merchandising_system:14.1.3.2:::::::*
cpe:2.3:a:oracle:timesten_in-memory_database::::::::				11.2.2.8.27
cpe:2.3:a:oracle:storagetek_acsls:8.5.1:::::::*
cpe:2.3:a:oracle:storagetek_tape_analytics:2.4:::::::*

関連情報、対策とツール

No	URL	タグ
1	https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm	Third Party Advisory
2	https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E
3	https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E
4	https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E
5	https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E
6	https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E
7	https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E
8	https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E
9	https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E	Mailing List Vendor Advisory
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/
11	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/
12	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/
13	https://security.gentoo.org/glsa/202011-18	Third Party Advisory
14	https://www.oracle.com//security-alerts/cpujul2021.html	Patch Third Party Advisory
15	https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
16	https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
17	https://www.oracle.com/security-alerts/cpujan2021.html	Patch Third Party Advisory
18	https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
19	https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory
20	https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm	Third Party Advisory
21	https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory
22	https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
23	https://www.oracle.com/security-alerts/cpujan2021.html	Patch Third Party Advisory
24	https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
25	https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
26	https://www.oracle.com//security-alerts/cpujul2021.html	Patch Third Party Advisory
27	https://security.gentoo.org/glsa/202011-18	Third Party Advisory
28	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/
29	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/
30	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/
31	https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E	Mailing List Vendor Advisory
32	https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E
33	https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E
34	https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E
35	https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E
36	https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E
37	https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E
38	https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E

共通脆弱性一覧

JVN脆弱性情報

Apache Ant における脆弱性

タイトル	Apache Ant における脆弱性
概要	Apache Ant には、不特定の脆弱性が存在します。
想定される影響	情報を改ざんされる可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2020年9月30日0:00
登録日	2021年4月22日17:19
最終更新日	2021年4月22日17:19

影響を受けるシステム

Apache Software Foundation

Apache Ant 1.10.8

オラクル

Oracle Banking Platform

Oracle Enterprise Repository

Oracle Financial Services Analytical Applications Infrastructure

Oracle Retail Financial Integration

Oracle Retail Integration Bus

Oracle Retail Service Backbone

Oracle Retail Store Inventory Management

Primavera Gateway

Primavera Unifier

Fedora Project

Fedora

Gradle Inc.

Gradle

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-11979	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11979
GitHub
2	CVE-2020-11979: Apache Ant insecure temporary file vulnerability	https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm
National Vulnerability Database (NVD)
3	CVE-2020-11979	https://nvd.nist.gov/vuln/detail/CVE-2020-11979

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	名前	URL
Fedora Update Notification
1	FEDORA-2020-2640aa4e19	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/
2	FEDORA-2020-3ce0f55bc5	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/
3	FEDORA-2020-92b1d001b3	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/
Oracle Critical Patch Update
4	Oracle Critical Patch Update Advisory - January 2021	https://www.oracle.com/security-alerts/cpujan2021.html
Pony Mail
5	[CVE-2020-11979] Apache Ant insecure temporary file vulnerability	https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E
6	[jira] [Assigned] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979	https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490@%3Cdev.creadur.apache.org%3E
7	[jira] [Commented] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979	https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e@%3Cdev.creadur.apache.org%3E
8	[jira] [Resolved] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8	https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305@%3Cdev.creadur.apache.org%3E
9	[jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979	https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc@%3Cdev.creadur.apache.org%3E
10	[jira] [Updated] (RAT-274) Update to at least Ant 1.10.8/1.9.15 in order to fix CVE-2020-11979 / raise compiler level to JDK8	https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0@%3Cdev.creadur.apache.org%3E

変更履歴

No	変更内容	変更日
1	[2021年04月22日] 掲載	2021年4月22日17:19

構成4	以上	以下	より上	未満
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:16.2:::::::*
cpe:2.3:a:oracle:banking_platform:2.4.0:::::::*
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:::::::*
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:::::::*
cpe:2.3:a:oracle:banking_platform:2.4.1:::::::*
cpe:2.3:a:oracle:primavera_unifier:16.1:::::::*
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:::::::*
cpe:2.3:a:oracle:retail_predictive_application_server:14.1:::::::*
cpe:2.3:a:oracle:banking_platform:2.6.2:::::::*
cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:::::::*
cpe:2.3:a:oracle:primavera_unifier::::::::	17.7	17.12
cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:::::::*
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:::::::*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:::::::*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:::::::*
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:::::::*
cpe:2.3:a:oracle:banking_platform:2.7.0:::::::*
cpe:2.3:a:oracle:banking_platform:2.7.1:::::::*
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:::::::*
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	16.2.0	16.2.11
cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.0:::::::*
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.9:::::::*
cpe:2.3:a:oracle:retail_service_backbone:15.0.3:::::::*
cpe:2.3:a:oracle:retail_service_backbone:16.0.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:15.0.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:16.0.3:::::::*
cpe:2.3:a:oracle:retail_financial_integration:14.1.3:::::::*
cpe:2.3:a:oracle:retail_service_backbone:14.1.3:::::::*
cpe:2.3:a:oracle:retail_integration_bus:15.0.3:::::::*
cpe:2.3:a:oracle:banking_platform:2.8.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:20.12:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	17.12.0	17.12.9
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:::::::*
cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:::::::*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:::::::*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:::::::*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure::::::::	8.0.6	8.0.9
cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:::::::*
cpe:2.3:a:oracle:retail_eftlink:19.0.1:::::::*
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:::::::*
cpe:2.3:a:oracle:retail_eftlink:20.0.0:::::::*
cpe:2.3:a:oracle:banking_treasury_management:14.4:::::::*
cpe:2.3:a:oracle:retail_regular_price_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:::::::*
cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_replenishment_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_merchandise_financial_planning:16.0.3:::::::*
cpe:2.3:a:oracle:retail_macro_space_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_item_planning:16.0.3:::::::*
cpe:2.3:a:oracle:retail_category_management_planning_\&_optimization:16.0.3:::::::*
cpe:2.3:a:oracle:retail_merchandising_system:14.1.3.2:::::::*
cpe:2.3:a:oracle:timesten_in-memory_database::::::::				11.2.2.8.27
cpe:2.3:a:oracle:storagetek_acsls:8.5.1:::::::*
cpe:2.3:a:oracle:storagetek_tape_analytics:2.4:::::::*