cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/vuxml: Add CVE-2020-1945: Apache Ant insecure temporary file vulnerability

Browse Source 
PR:		248098
Submitted by:	mikael
This commit is contained in:
Kurt Jaeger 2020-09-28 11:23:27 +00:00
parent 3f77de387b
commit 345d090124
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=550420
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
security/vuxml/vuln.xml
View File

@ -58,6 +58,39 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="6d5f1b0b-b865-48d5-935b-3fb6ebb425fc">
<topic>Apache Ant leaks sensitive information via the java.io.tmpdir</topic>
<affects>
<package>
<name>apache-ant</name>
<range><ge>1.1</ge><lt>1.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel">
<p>Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the
default temporary directory identified by the Java
system property java.io.tmpdir for several tasks and
may thus leak sensitive information. The fixcrlf and
replaceregexp tasks also copy files from the temporary
directory back into the build tree allowing an attacker
to inject modified source files into the build
process.</p>
</blockquote>
</body>
</description>
<references>
<url>https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel</url>
<cvename>CVE-2020-1945</cvename>
</references>
<dates>
<discovery>2020-05-14</discovery>
<entry>2020-09-28</entry>
</dates>
</vuln>
<vuln vid="b371db92-fe34-11ea-b90e-6805ca2fa271">
<topic>powerdns -- Leaking uninitialised memory through crafted zone records</topic>
<affects>