Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2020-11979

Creation of Temporary File in Directory with Insecure Permissions

Published: Oct 01, 2020 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
6.2 MODERATE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-11979
CWEhttps://cwe.mitre.org/data/definitions/379.html

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Weakness

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file’s existence or otherwise access that file.

Affected Software

NameVendorStart VersionEnd Version
AntApache1.10.8 (including)1.10.8 (including)
Red Hat OpenShift Container Platform 3.11RedHatjenkins-0:2.263.3.1612433584-1.el7*
Red Hat OpenShift Container Platform 4.5RedHatconmon-2:2.0.21-1.rhaos4.5.el7*
Red Hat OpenShift Container Platform 4.5RedHatjenkins-0:2.263.3.1612434332-1.el7*
Red Hat OpenShift Container Platform 4.5RedHatmachine-config-daemon-0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8*
Red Hat OpenShift Container Platform 4.5RedHatopenshift-0:4.5.0-202102050524.p0.git.0.9229406.el7*
Red Hat OpenShift Container Platform 4.5RedHatopenshift-ansible-0:4.5.0-202102031005.p0.git.0.c6839a2.el7*
Red Hat OpenShift Container Platform 4.5RedHatopenshift-clients-0:4.5.0-202102051529.p0.git.3612.61b096a.el7*
Red Hat OpenShift Container Platform 4.5RedHatrunc-0:1.0.0-72.rhaos4.5.giteadfc6b.el8*
Red Hat OpenShift Container Platform 4.6RedHatjenkins-0:2.263.3.1612434510-1.el8*
AntUbuntubionic*
AntUbuntufocal*
AntUbuntugroovy*
AntUbuntutrusty*
AntUbuntutrusty/esm*
AntUbuntuxenial*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use