Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
203
security advisorycritical issuecriticalMageia 7: 2021-0173 Critical Advisory on Apache Ant Code Injection
Updated ant packages fix security vulnerability: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file . MGASA-2021-0173 - Updated ant packages fix security vulnerability Publication date: 03 Apr 2021 URL: https://advisories.mageia.org/MGASA-2021-0173.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-11979 Updated ant packages fix security vulnerability: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process(CVE-2020-11979). References: - https://bugs.mageia.org/show_bug.cgi?id=27386 - https://www.openwall.com/lists/oss-security/2020/09/30/6 - https://ant.apache.org/security.html - https://www.cve.org/CVERecord?id=CVE-2020-11979 SRPMS: - 7/core/ant-1.10.9-1.mga7 . Latest updates for Ant packages have been released to address a vulnerability permitting code execution due to a permissions error. Refer to the Mageia advisory for further information.. Mageia Ant Update,Critical Security Fix,Code Injection Risk,Apache Ant Permissions Issue. . Severity: Critical. LinuxSecurity.com Team
Apr 03, 2021
•Critical
Mageia
91
security advisorygentootemporary fileGentoo: GLSA-202011-18 Normal Severity: Apache Ant Symlink Attack Risk
Apache Ant uses various insecure temporary files possibly allowing local code execution.. Linux Security Advisory GLSA 202011-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Apache Ant: Insecure temporary file Date: November 16, 2020 Bugs: #745768 ID: 202011-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Apache Ant uses various insecure temporary files possibly allowing local code execution. Background ========= Ant is a Java-based build tool similar to ‘make’ that uses XML configuration files. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/ant < 1.10.9 > = 1.10.9 Description ========== A previous fix for a security vulnerability involving insecure temporary files has been found to be incomplete. Impact ===== A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All Apache Ant users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-java/ant-1.10.9" References ========= [ 1 ] CVE-2020-11979 https://nvd.nist.gov/vuln/detail/CVE-2020-11979 [ 2 ] GLSA-202007-34 https://security.gentoo.org/glsa/202007-34 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202011-18 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuringthe confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Nov 15, 2020
Gentoo
203
security advisoryinformation leakcriticalMageia: 2020-0237 Critical: Apache Ant Task Injection Security Issue
Updated ant packages fix security vulnerability: Apache Ant uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy . MGASA-2020-0237 - Updated ant packages fix security vulnerability Publication date: 27 May 2020 URL: https://advisories.mageia.org/MGASA-2020-0237.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-1945 Updated ant packages fix security vulnerability: Apache Ant uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process (CVE-2020-1945). The ant package has been updated to version 1.10.8 to fix this issue and other bugs. References: - https://bugs.mageia.org/show_bug.cgi?id=26618 - https://ant.apache.org/security.html - https://ant.apache.org/antnews.html - https://www.cve.org/CVERecord?id=CVE-2020-1945 SRPMS: - 7/core/ant-1.10.8-1.mga7 . The latest Ant updates for Mageia address a critical security vulnerability that exposes sensitive information in the default Java directory.. Apache Ant Update, Mageia Security Fix, Task Injection Issue, Data Leak Vulnerability. . Severity: Critical. LinuxSecurity.com Team
May 27, 2020
•Critical
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!