diff options
| author | Kurt Jaeger <pi@FreeBSD.org> | 2020-09-28 11:23:27 +0000 |
|---|---|---|
| committer | Kurt Jaeger <pi@FreeBSD.org> | 2020-09-28 11:23:27 +0000 |
| commit | 345d090124e4e153fae3596e6760a11d5368d894 (patch) | |
| tree | bde13971005b668dac021c3aad4ffda51ea812d8 /security | |
| parent | 3f77de387b4a81e86a643b35ee2e28bfb304945e (diff) | |
| download | freebsd-ports-345d090124e4e153fae3596e6760a11d5368d894.zip | |
security/vuxml: Add CVE-2020-1945: Apache Ant insecure temporary file vulnerability
PR: 248098
Submitted by: mikael
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index ac8e4c881fe5..0d93c609278c 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,39 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="6d5f1b0b-b865-48d5-935b-3fb6ebb425fc"> + <topic>Apache Ant leaks sensitive information via the java.io.tmpdir</topic> + <affects> + <package> + <name>apache-ant</name> + <range><ge>1.1</ge><lt>1.10.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Apache reports:</p> + <blockquote cite="https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel"> + <p>Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the + default temporary directory identified by the Java + system property java.io.tmpdir for several tasks and + may thus leak sensitive information. The fixcrlf and + replaceregexp tasks also copy files from the temporary + directory back into the build tree allowing an attacker + to inject modified source files into the build + process.</p> + </blockquote> + </body> + </description> + <references> + <url>https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel</url> + <cvename>CVE-2020-1945</cvename> + </references> + <dates> + <discovery>2020-05-14</discovery> + <entry>2020-09-28</entry> + </dates> + </vuln> + <vuln vid="b371db92-fe34-11ea-b90e-6805ca2fa271"> <topic>powerdns -- Leaking uninitialised memory through crafted zone records</topic> <affects> |