Ant
Monthly
Relative path traversal in Apache Ant's built-in `ftp` and `scp` tasks (versions 1.2 through 1.10.17) permits a malicious or MITM-intercepted remote server to supply server-controlled paths that escape the configured download directory, overwriting arbitrary files with the filesystem permissions of the Ant process. For FTP tasks not using FTPS, no server identity check is enforced, making a network MITM attacker sufficient to trigger the write primitive without needing a valid certificate. The vulnerability is fixed in Ant 1.10.18, which validates destination paths by default; no public exploit code has been identified and EPSS is low at 0.19%.
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. Rated medium severity (CVSS 6.3). This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Relative path traversal in Apache Ant's built-in `ftp` and `scp` tasks (versions 1.2 through 1.10.17) permits a malicious or MITM-intercepted remote server to supply server-controlled paths that escape the configured download directory, overwriting arbitrary files with the filesystem permissions of the Ant process. For FTP tasks not using FTPS, no server identity check is enforced, making a network MITM attacker sufficient to trigger the write primitive without needing a valid certificate. The vulnerability is fixed in Ant 1.10.18, which validates destination paths by default; no public exploit code has been identified and EPSS is low at 0.19%.
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. Rated medium severity (CVSS 6.3). This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.