Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

An update of the apache package has been released.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ant: insecure temporary file vulnerability (CVE-2020-1945)

  - When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - ant: insecure temporary file vulnerability (CVE-2020-1945)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4874-1 advisory.

    It was discovered that Apache Ant created temporary files with insecure permissions. An attacker could use     this vulnerability to read sensitive information leaked into /tmp, or potentially inject malicious code     into a project that is built with Apache Ant.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Apache Log4j). The supported version that is affected is 12.4.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access to compromise Oracle Enterprise Manager Ops Center.
    Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Ops Center.
    (CVE-2017-5645)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Networking (Apache Ant)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Enterprise Manager Ops Center accessible data as     well as unauthorized access to critical data or complete access to all Enterprise Manager Ops Center     accessible data (CVE-2020-1945).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4022-1 advisory.

  - As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so     that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the     temporary file and created a new one without said protection, effectively nullifying the effort. This     would still allow an attacker to inject modified source files into the build process. (CVE-2020-11979)

  - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java     system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and     replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an     attacker to inject modified source files into the build process. (CVE-2020-1945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0429 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.5.33. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:0428

    Security Fix(es):

    * jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

    * jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

    * jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

    * jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

    * jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

    * jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

    * ant: insecure temporary file vulnerability (CVE-2020-1945)

    * ant: insecure temporary file (CVE-2020-11979)

    * jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

    * jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

    * jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

    * jenkins: Filesystem traversal by privileged users (CVE-2021-21615)

    * jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

    * jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

    * ant: Insecure temporary file vulnerability (CVE-2020-1945)

    * jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

    * jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes     plug-in (CVE-2020-2307)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes plug-in allows enumerating     credentials IDs (CVE-2020-2309)

    * ant: Insecure temporary file (CVE-2020-11979)

    * python-rsa: Bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 3.11.394. See the following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:0638

    Space precludes documenting all of the container images in this advisory. See the following Release Notes     documentation, which will be updated shortly for this release, for details about these changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    This update fixes the following bugs among others:

    * Previously, the restart-cluster playbook did not evaluate the defined cluster size for ops clusters.
    This was causing come clusters to never complete their restart. This bug fix passes the logging ops     cluster size, allowing restarts of ops clusters to complete successfully. (BZ#1879407)

    * Previously, the `openshift_named_certificates` role checked the contents of the `ca-bundle.crt` file     during cluster installation. This caused the check to fail during initial installation because the `ca-     bundle.crt` file is not yet created in that scenario. This bug fix allows the cluster to skip checking the     `ca-bundle.crt` file if it does not exist, resulting in initial installations succeeding. (BZ#1920567)

    * Previously, if the `openshift_release` attribute was not set in the Ansible inventory file, the nodes of     the cluster would fail during an upgrade. This was caused by the `cluster_facts.yml` file being gathered     before the `openshift_release` attribute was defined by the upgrade playbook. Now the `cluster_facts.yml`     file is gathered after the `openshift_version` role runs and the `openshift_release` attribute is set,     allowing for successful node upgrades. (BZ#1921353)

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0423 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.6.17. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHBA-2021:0424

    Security Fix(es):

    * jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

    * jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

    * jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

    * jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

    * jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

    * jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

    * ant: insecure temporary file vulnerability (CVE-2020-1945)

    * ant: insecure temporary file (CVE-2020-11979)

    * jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

    * jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

    * jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

    * jenkins: Filesystem traversal by privileged users (CVE-2021-21615)

    * jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the ant package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the     default temporary directory identified by the Java     system property java.io.tmpdir for several tasks and     may thus leak sensitive information. The fixcrlf and     replaceregexp tasks also copy files from the temporary     directory back into the build tree allowing an attacker     to inject modified source files into the build     process.(CVE-2020-1945)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Business Process Management Suite installed on the remote host is affected by the following vulnerabilities as referenced in the October 2020 CPU advisory:  

  - Vulnerability in the Runtime Engine (Application Development Framework). An unauthenticated, remote     attacker with network access via HTTP can exploit this issue to compromise the Oracle Business Process     Management Suite. Successful attacks require human interaction from a person other than the attacker and     while the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Business Process Management Suite accessible data as well as unauthorized     read access to a subset of Oracle Business Process Management Suite accessible data. (CVE-2019-2904)

  - Vulnerability in the Runtime Engine (Apache Ant). An authenticated, local attacker can exploit this issue     to compromise the Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Oracle Business     Process Management Suite accessible data as well as unauthorized access to critical data or complete     access to all Oracle Business Process Management Suite accessible data. (CVE-2020-1945)

  - Vulnerability in the Runtime Engine (jQuery). An unauthenticated, remote attacker with network access via     HTTP can exploit this issue to compromise Oracle Business Process Management Suite. Successful attacks     require human interaction from a person other than the attacker and while the vulnerability is in Oracle     Business Process Management Suite, attacks may significantly impact additional products. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Business Process Management Suite accessible data as well as unauthorized read access to a subset of     Oracle Business Process Management Suite accessible data. (CVE-2019-11358)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

Apache reports :

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

According to the version of the ant packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the     default temporary directory identified by the Java     system property java.io.tmpdir for several tasks and     may thus leak sensitive information. The fixcrlf and     replaceregexp tasks also copy files from the temporary     directory back into the build tree allowing an attacker     to inject modified source files into the build     process.(CVE-2020-1945)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-34 (Apache Ant: Multiple vulnerabilities)

    Apache Ant was found to be using multiple insecure temporary files which       may disclose sensitive information or execute code from an unsafe local       location.
  Impact :

    A local attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for ant fixes the following issues :

  - CVE-2020-1945: Fixed an inseure temorary file     vulnerability which could have potentially leaked     sensitive information (bsc#1171696).&#9; 

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The 16.2.0-16.2.11, 17.12.0-17.12.7, 18.8.0-18.8.9, and 19.12.0-19.12.4 versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle     Construction and Engineering (component: Admin (Apache     Ant)). Supported versions that are affected are     16.2.0-16.2.11 and 17.12.0-17.12.7. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Primavera Gateway.
    Successful attacks of this vulnerability can result in     takeover of Primavera Gateway.

  - Vulnerability in the Primavera Gateway product of Oracle     Construction and Engineering (component: Admin     (jQuery)). Supported versions that are affected are     16.2.0-16.2.11, 17.12.0-17.12.7, 18.8.0-18.8.9 and     19.12.0-19.12.4. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to     compromise Primavera Gateway. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Primavera Gateway,     attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Primavera Gateway accessible data as well as     unauthorized read access to a subset of Primavera     Gateway accessible data.

  - Vulnerability in the Primavera Gateway product of Oracle     Construction and Engineering (component: Admin (Log4j)).
    Supported versions that are affected are 16.2.0-16.2.11,     17.12.0-17.12.7, 18.8.0-18.8.9 and 19.12.0-19.12.4.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via SMTPS     to compromise Primavera Gateway. Successful attacks of     this vulnerability can result in unauthorized read     access to a subset of Primavera Gateway accessible data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.16.2, or 17.7.x through 17.12.x prior to 17.12.11.4, or 18.8.x prior to 18.8.17, or 19.12.x prior to 19.12.7. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (jackson-databind)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8 and 19.12.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera     Unifier. (CVE-2020-9546)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core     (Apache Ant)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8 and 19.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized     access to critical data or complete access to all Primavera Unifier accessible data. (CVE-2020-1945)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Mobile     App). The supported version that is affected is Prior to 20.6. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Primavera Unifier. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized access to critical data or complete access to all Primavera Unifier accessible     data as well as unauthorized update, insert or delete access to some of Primavera Unifier accessible data.
    (CVE-2020-14618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to version 1.10.8.

Resolves: CVE-2020-1945

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Apache Ant created temporary files with insecure permissions. An attacker could use this vulnerability to read sensitive information leaked into /tmp, or potentially inject malicious code into a project that is built with Apache Ant.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
202893	Photon OS 2.0: Apache PHSA-2020-2.0-0247	Nessus	PhotonOS Local Security Checks	medium
199373	RHEL 8 : ant (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199310	RHEL 7 : ant (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196531	RHEL 6 : ant (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
183115	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Apache Ant vulnerability (USN-4874-1)	Nessus	Ubuntu Local Security Checks	medium
169979	Oracle Enterprise Manager Ops Center UI and Other Patches (Jul 2020 CPU)	Nessus	Misc.	critical
167779	SUSE SLES12 Security Update : ant (SUSE-SU-2022:4022-1)	Nessus	SuSE Local Security Checks	high
147015	RHEL 7 / 8 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)	Nessus	Red Hat Local Security Checks	high
147013	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	Nessus	Red Hat Local Security Checks	high
146566	RHEL 8 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)	Nessus	Red Hat Local Security Checks	high
142265	EulerOS 2.0 SP2 : ant (EulerOS-SA-2020-2327)	Nessus	Huawei Local Security Checks	medium
142210	Oracle Business Process Management Suite (Oct 2020 CPU)	Nessus	Misc.	critical
140937	FreeBSD : Apache Ant leaks sensitive information via the java.io.tmpdir (6d5f1b0b-b865-48d5-935b-3fb6ebb425fc)	Nessus	FreeBSD Local Security Checks	medium
140899	EulerOS 2.0 SP3 : ant (EulerOS-SA-2020-2132)	Nessus	Huawei Local Security Checks	medium
140136	EulerOS 2.0 SP5 : ant (EulerOS-SA-2020-1915)	Nessus	Huawei Local Security Checks	medium
139124	EulerOS 2.0 SP8 : ant (EulerOS-SA-2020-1794)	Nessus	Huawei Local Security Checks	medium
138957	GLSA-202007-34 : Apache Ant: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
138789	openSUSE Security Update : ant (openSUSE-2020-1022)	Nessus	SuSE Local Security Checks	medium
138526	Oracle Primavera Gateway (Jul 2020 CPU)	Nessus	CGI abuses	critical
138508	Oracle Primavera Unifier Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	CGI abuses	critical
137317	Photon OS 1.0: Apache PHSA-2020-1.0-0298	Nessus	PhotonOS Local Security Checks	high
137199	Photon OS 3.0: Apache PHSA-2020-3.0-0099	Nessus	PhotonOS Local Security Checks	medium
137116	Fedora 32 : ant (2020-7f07da3fef)	Nessus	Fedora Local Security Checks	medium
137046	Ubuntu 19.10 : Apache Ant vulnerability (USN-4380-1)	Nessus	Ubuntu Local Security Checks	medium
137009	Fedora 31 : ant (2020-52741b0a49)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-1945

medium

Tenable Plugins

medium

medium

medium

high

medium

critical

high

high

high

high

medium

critical

medium

medium

medium

medium

medium

medium

critical

critical

high

medium

medium

medium

medium