Insecure Temporary File Vulnerability in Apache Ant

CVE-2020-1945

Summary

Apache Ant versions from 1.1 to 1.9.14 and from 1.10.0 to 1.10.7 utilize the default temporary directory defined by the Java property java.io.tmpdir for various operations. This practice poses a risk of leaking sensitive user information. Furthermore, tasks such as fixcrlf and replaceregexp can inadvertently copy files from this insecure temporary directory back into the build environment, enabling a potential attacker to inject altered source files into the build process. This flaw underscores the importance of secure file handling practices within development tools.

References