CVE-2020-11979 Code injection in Apache Ant

What is CVE-2020-11979?

CVE-2020-11979 is a high-severity vulnerability in Fedoraproject Fedora, published on 1 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Weakness: CWE-379

Which versions are affected by CVE-2020-11979?

3 open source packages ship an affected version, including org.apache.ant:ant and gradle. It affects 37 products.

Products include Apache Ant, Fedoraproject Fedora, Gradle Gradle, Oracle Agile Engineering Data Management, Oracle Api Gateway, Oracle Banking Platform and 31 more.

How do I fix CVE-2020-11979?

Upgrade org.apache.ant:ant to 1.10.9 or later.

Is CVE-2020-11979 being exploited?

There is no known exploitation of CVE-2020-11979 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2026-78254 Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write High 7.4
• CVE-2020-1945 Sensitive Data Exposure in Apache Ant Medium 6.3
• CVE-2021-36373 Apache Ant TAR archive denial of service vulnerability Medium 5.5
• CVE-2021-36374 Apache Ant ZIP, and ZIP based, archive denial of service vulerability Medium 5.5

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as BIT-gradle-2020-11979, CLEANSTART-2025-TN67221, CLEANSTART-2026-QY29190, CLEANSTART-2026-RX54054, DEBIAN-CVE-2020-11979, GHSA-f62v-xpxf-3v68 and 6 more.