CVE-2020-1945 Sensitive Data Exposure in Apache Ant
Apache Ant leaks sensitive data via shared temp directories and allows source file injection, impacting build integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1945?
CVE-2020-1945 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 14 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
Weakness: CWE-668
Which versions are affected by CVE-2020-1945?
4 open source packages ship an affected version, including org.apache.ant:ant. It affects 50 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.ant:ant Maven | From 1.1 | 1.9.15 |
org.apache.ant:ant Maven | From 1.1 | 1.9.15 |
org.apache.ant:ant Maven | From 1.10.0 | 1.10.8 |
org.apache.ant:ant Maven | From 1.10.0 | 1.10.8 |
Linux distribution packages (8)
ant SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.10.7-4.3.1 |
ant-antlr SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.10.7-4.3.1 |
ant-junit SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.10.7-4.3.1 |
ant openSUSE:Leap 15.2 | All versions | 1.10.7-lp152.2.3.1 |
ant-antlr openSUSE:Leap 15.2 | All versions | 1.10.7-lp152.2.3.1 |
ant-junit openSUSE:Leap 15.2 | All versions | 1.10.7-lp152.2.3.1 |
ant-junit5 openSUSE:Leap 15.2 | All versions | 1.10.7-lp152.2.3.1 |
junit openSUSE:Tumbleweed | All versions | 4.13.2-1.1 |
Products include Apache Ant, Canonical Ubuntu Linux, Fedoraproject Fedora, Opensuse Leap, Oracle Agile Engineering Data Management, Oracle Banking Enterprise Collections and 44 more.
How do I fix CVE-2020-1945?
Upgrade org.apache.ant:ant to a fixed version for your release line: 1.9.15 or 1.10.8.
Is CVE-2020-1945 being exploited?
There is no known exploitation of CVE-2020-1945 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as CLEANSTART-2025-RL13274, DEBIAN-CVE-2020-1945, GHSA-4p6w-m9wc-c9c9, MGASA-2020-0237, MINI-56x6-4pm6-mgfh, MINI-fvvf-9gxq-m3g6 and 6 more.