WaratekVRT Sign in

CVE-2020-1945 Apache Ant

Affected softwareApache Ant
Severity6.3 Medium CVSS 3.1 2 scores
Fixed in1.9.15, 1.10.8
WeaknessInformation exposure (CWE-200)
Published14 May 2020
Updated17 Jun 2026

Description

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

CWE-668

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 1.8% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

6.3 MEDIUM v3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.3 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N NVD Primary published
CVSS 2.0 3.3 none AV:L/AC:M/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Fusion Middleware / Third Party (Apache Ant) (12.2.1.4.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Enterprise Manager / Load Testing for Web Apps (Apache Ant) (13.3.0.1)
Oracle Critical Patch Update October 2021 ↗ CPU 2021-Q4 Oracle Retail Applications / Return Tickets (Apache Ant) (14.0, 14.1)
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Fusion Middleware / Install, config, upgrade (Apache Ant) (12.2.1.3.0, 12.2.1.4.0)
Oracle Critical Patch Update April 2021 ↗ CPU 2021-Q2 Oracle Health Sciences Applications / Health Record Locator (Apache Ant) (3.0.0-3.0.2)
Oracle Critical Patch Update January 2021 ↗ CPU 2021-Q1 Oracle Communications Applications / Core (Apache Ant) (7.3)
Oracle Financial Services Applications / Common (Apache Ant) (14.0.0-14.4.0)
Oracle Fusion Middleware / Decision Studio (Apache Ant) (3.2.1.0)
Oracle Retail Applications / Mathematical Operators (Apache Ant) (13.2.5, 13.2.8)
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Communications / IDIH (Apache Ant) (IDIH: 8.0.0-8.2.2)
Oracle Fusion Middleware / Runtime Engine (Apache Ant) (12.2.1.3.0, 12.2.1.4.0)
Oracle Retail Applications / RIB Kernal (Apache Ant) (14.1, 15.0, 16.0)
Oracle Retail Applications / Security (Apache Ant) (14.0, 14.1)
Oracle Retail Applications / Security (Apache Ant) (14.0, 14.1)
Oracle Retail Applications / Security (Apache Ant) (14.0, 14.1)
Oracle Retail Applications / Security (Apache Ant) (14.0, 14.1)
Oracle Utilities Applications / General (Apache Ant) (2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 - 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0)
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Communications Applications / Installer (Apache Ant) (7.3, 7.4)
Oracle Communications Applications / Online Help (Apache Ant) (6.3.0)
Oracle Construction and Engineering / Core (Apache Ant) (16.1, 16.2, 17.7-17.12, 18.8, 19.12)
Oracle Enterprise Manager / Networking (Apache Ant) (12.4.0.0)
Oracle Financial Services Applications / Infrastructure (Apache Ant) (12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0)
Oracle Financial Services Applications / Infrastructure (Apache Ant) (8.0.6-8.1.0)
Oracle Financial Services Applications / Installer (Apache Ant) (2.4.0-2.9.0)
Oracle Financial Services Applications / Installer (Apache Ant) (2.7.0-2.9.0)
Oracle Financial Services Applications / Utilities (Apache Ant) (12.0.0, 12.1.0)
Oracle Fusion Middleware / Security Subsystem (Apache Ant) (11.1.1.7.0)
Oracle Fusion Middleware / Studio (Apache Ant) (3.2.0)
Oracle Retail Applications / Application Core (Apache Ant) (15.0.3)
Oracle Retail Applications / Application Core (Apache Ant) (15.0.3)
Oracle Retail Applications / Application Core (Apache Ant) (15.0.3)
Oracle Retail Applications / Application Core (Apache Ant) (15.0.3)
Oracle Retail Applications / Application Core (Apache Ant) (15.0.3, 16.0.3)
Oracle Retail Applications / BDI Job Scheduler (Apache Ant) (15.0, 16.0)
Oracle Retail Applications / Install (Apache Ant) (15.0, 16.0)
Oracle Retail Applications / ODI Integration (Apache Ant) (15.0.3)
Oracle Retail Applications / ODI Integration (Apache Ant) (15.0.3)
Oracle Retail Applications / ODI Knowledge Module (Apache Ant) (1.9, 1.10)
Oracle Retail Applications / Operations & Maintenance (Apache Ant) (15.0.3, 16.0.3)
Oracle Retail Applications / PeopleSoft Integration (Apache Ant) (15.0, 16.0)
Oracle Retail Applications / RPAS Server (Apache Ant) (14.0.3, 14.1.3, 15.0.3, 16.0.3)
Oracle Retail Applications / SIM Integration (Apache Ant) (14.0.4, 14.1.3, 15.0.3, 16.0.3)
Oracle Supply Chain / Middle Tier (Apache Ant) (12.1, 12.2)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications IDIH (Apache Ant) IDIH: 8.0.0-8.2.2
Oracle Communications Applications Core (Apache Ant) 7.3 7.3
Oracle Communications Applications Installer (Apache Ant) 7.3, 7.4 7.3 · 7.4
Oracle Communications Applications Online Help (Apache Ant) 6.3.0 6.3.0
Oracle Construction and Engineering Core (Apache Ant) 16.1, 16.2, 17.7-17.12, 18.8, 19.12 16.1 · 16.2 · 18.8 · 19.12
Oracle Enterprise Manager Load Testing for Web Apps (Apache Ant) 13.3.0.1 13.3.0.1
Oracle Enterprise Manager Networking (Apache Ant) 12.4.0.0 12.4.0.0
Oracle Financial Services Applications Common (Apache Ant) 14.0.0-14.4.0
Oracle Financial Services Applications Infrastructure (Apache Ant) 8.0.6-8.1.0 12.1.0 · 12.3.0 · 12.4.0 · 14.0.0 · 14.1.0
Oracle Financial Services Applications Installer (Apache Ant) 2.4.0-2.9.0
Oracle Financial Services Applications Utilities (Apache Ant) 12.0.0, 12.1.0 12.0.0 · 12.1.0
Oracle Fusion Middleware Decision Studio (Apache Ant) 3.2.1.0 3.2.1.0
Oracle Fusion Middleware Install, config, upgrade (Apache Ant) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Runtime Engine (Apache Ant) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Security Subsystem (Apache Ant) 11.1.1.7.0 11.1.1.7.0
Oracle Fusion Middleware Studio (Apache Ant) 3.2.0 3.2.0
Oracle Fusion Middleware Third Party (Apache Ant) 12.2.1.4.0 12.2.1.4.0
Oracle Health Sciences Applications Health Record Locator (Apache Ant) 3.0.0-3.0.2
Oracle Retail Applications Application Core (Apache Ant) 15.0.3 15.0.3 · 16.0.3
Oracle Retail Applications BDI Job Scheduler (Apache Ant) 15.0, 16.0 15.0 · 16.0
Oracle Retail Applications Install (Apache Ant) 15.0, 16.0 15.0 · 16.0
Oracle Retail Applications Mathematical Operators (Apache Ant) 13.2.5, 13.2.8 13.2.5 · 13.2.8
Oracle Retail Applications ODI Integration (Apache Ant) 15.0.3 15.0.3
Oracle Retail Applications ODI Knowledge Module (Apache Ant) 1.9, 1.10 1.9 · 1.10
Oracle Retail Applications Operations & Maintenance (Apache Ant) 15.0.3, 16.0.3 15.0.3 · 16.0.3
Oracle Retail Applications PeopleSoft Integration (Apache Ant) 15.0, 16.0 15.0 · 16.0
Oracle Retail Applications RIB Kernal (Apache Ant) 14.1, 15.0, 16.0 14.1 · 15.0 · 16.0
Oracle Retail Applications RPAS Server (Apache Ant) 14.0.3, 14.1.3, 15.0.3, 16.0.3 14.0.3 · 14.1.3 · 15.0.3 · 16.0.3
Oracle Retail Applications Return Tickets (Apache Ant) 14.0, 14.1 14.0 · 14.1
Oracle Retail Applications SIM Integration (Apache Ant) 14.0.4, 14.1.3, 15.0.3, 16.0.3 14.0.4 · 14.1.3 · 15.0.3 · 16.0.3
Oracle Retail Applications Security (Apache Ant) 14.0, 14.1 14.0 · 14.1
Oracle Supply Chain Middle Tier (Apache Ant) 12.1, 12.2 12.1 · 12.2
Oracle Utilities Applications General (Apache Ant) 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 - 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 2.2.0.0.0 · 4.2.0.2.0 · 4.2.0.3.0 · 4.4.0.0.0 · 4.4.0.2.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.ant:ant 1.1 1.9.15 unbounded
org.apache.ant:ant 1.10.0 1.10.8 unbounded

Products and versions

51 products, 119 version entries
SourceVendorProductSchemeAffected versions
nvd apache ant generic ≥ 1.1 and ≤ 1.9.14 · ≥ 1.10.0 and ≤ 1.10.7
nvd canonical ubuntu linux generic 19.10
nvd fedoraproject fedora generic 31 · 32
nvd opensuse leap generic 15.2
nvd oracle agile engineering data management generic 6.2.1.0
nvd oracle banking enterprise collections generic ≥ 2.7.0 and ≤ 2.9.0
nvd oracle banking liquidity management generic ≥ 14.0.0 and ≤ 14.4.0
nvd oracle banking platform generic ≥ 2.4.0 and ≤ 2.9.0
nvd oracle business process management suite generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle category management planning \& optimization generic 15.0.3
nvd oracle communications asap generic 7.3
nvd oracle communications diameter signaling router generic ≥ 8.0.0 and ≤ 8.2.2
nvd oracle communications metasolv solution generic 6.3.0
nvd oracle communications order and service management generic 7.3 · 7.4
nvd oracle data integrator generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle endeca information discovery studio generic 3.2.0
nvd oracle enterprise manager ops center generic 12.4.0.0
nvd oracle enterprise repository generic 11.1.1.7.0
nvd oracle financial services analytical applications infrastructure generic ≥ 8.0.6 and ≤ 8.1.0
nvd oracle flexcube investor servicing generic 12.1.0 · 12.3.0 · 12.4.0 · 14.0.0 · 14.1.0
nvd oracle flexcube private banking generic 12.0.0 · 12.1.0
nvd oracle health sciences information manager generic ≥ 3.0 and ≤ 3.0.2
nvd oracle primavera gateway generic ≥ 16.2.0 and ≤ 16.2.11 · ≥ 17.12.0 and ≤ 17.12.7
nvd oracle primavera unifier generic 16.1 · 16.2 · ≥ 17.7 and ≤ 17.12 · 18.8 · 19.12
nvd oracle rapid planning generic 12.1 · 12.2
nvd oracle real-time decision server generic 3.2.1.0
nvd oracle retail advanced inventory planning generic 14.1 · 15.0 · 16.0
nvd oracle retail assortment planning generic 15.0.3 · 16.0.3
nvd oracle retail back office generic 14.0 · 14.1
nvd oracle retail bulk data integration generic 15.0 · 16.0 · 16.0.3.0 · 19.0.1
nvd oracle retail central office generic 14.0 · 14.1
nvd oracle retail data extractor for merchandising generic 1.9 · 1.10
nvd oracle retail extract transform and load generic 13.2.5 · 13.2.8
nvd oracle retail financial integration generic 14.1.3.2 · 15.0 · 15.0.4.0 · 16.0 · 16.0.3.0
nvd oracle retail integration bus generic 14.1 · 14.1.3.2 · 15.0 · 15.0.4.0 · 16.0 · 16.0.3.0 · 19.0.1.0
nvd oracle retail item planning generic 15.0.3
nvd oracle retail macro space optimization generic 15.0.3
nvd oracle retail merchandise financial planning generic 15.0.3
nvd oracle retail merchandising system generic 19.0.1
nvd oracle retail point-of-service generic 14.0 · 14.1 · 15.0 · 16.0
nvd oracle retail predictive application server generic 14.0.3 · 14.1.3 · 15.0.3 · 16.0.3 · 16.0.3.0
nvd oracle retail regular price optimization generic 15.0.3 · 16.0.3
nvd oracle retail replenishment optimization generic 15.0.3
nvd oracle retail returns management generic 14.0 · 14.1
nvd oracle retail service backbone generic 14.1.3.2 · 15.0 · 15.0.4.0 · 16.0 · 16.0.3.0 · 19.0.1.0
nvd oracle retail size profile optimization generic 15.0.3 · 16.0.3
nvd oracle retail store inventory management generic 14.0.4 · 14.1 · 14.1.3 · 15.0 · 15.0.3 · 16.0 · 16.0.3
nvd oracle retail xstore point of service generic 15.0.4 · 16.0.6 · 17.0.4 · 18.0.3 · 19.0.2
nvd oracle timesten in-memory database generic ＜ 11.2.2.8.27 · 11.2.2.8.49
nvd oracle utilities framework generic 2.2.0.0.0 · 4.2.0.2.0 · 4.2.0.3.0 · ≥ 4.3.0.1.0 and ≤ 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0
osv org.apache.ant ant generic ≥ 1.1 and ＜ 1.9.15 · ≥ 1.10.0 and ＜ 1.10.8

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** OPERATIONS & MAINTENANCE (APACHE ANT), STUDIO (APACHE ANT), COMMON (APACHE ANT), APPLICATION CORE (APACHE ANT), HEALTH RECORD LOCATOR (APACHE ANT), CORE (APACHE ANT), NO AUTH REMOTE EXPLOIT, RPAS SERVER (APACHE ANT), MATHEMATICAL OPERATORS (APACHE ANT), RIB KERNAL (APACHE ANT), SECURITY (APACHE ANT), MIDDLE TIER (APACHE ANT), GENERAL (APACHE ANT), IDIH (APACHE ANT), BDI JOB SCHEDULER (APACHE ANT), INSTALLER (APACHE ANT), SECURITY SUBSYSTEM (APACHE ANT), DECISION STUDIO (APACHE ANT), HTTP, ONLINE HELP (APACHE ANT), ODI INTEGRATION (APACHE ANT), INSTALL, SIM INTEGRATION (APACHE ANT), ODI KNOWLEDGE MODULE (APACHE ANT), NETWORKING (APACHE ANT), UPGRADE (APACHE ANT), RUNTIME ENGINE (APACHE ANT), INSTALL (APACHE ANT), UTILITIES (APACHE ANT), CONFIG, PEOPLESOFT INTEGRATION (APACHE ANT), INFRASTRUCTURE (APACHE ANT), RETURN TICKETS (APACHE ANT) **Products:** PRIMAVERA UNIFIER, ORACLE COMMUNICATIONS ORDER AND SERVICE MANAGEMENT, ORACLE ENTERPRISE MANAGER, ORACLE DATA INTEGRATOR, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE RETAIL POINT-OF-SERVICE, ORACLE UTILITIES FRAMEWORK, ORACLE RETAIL FINANCIAL INTEGRATION, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE RETAIL BULK DATA INTEGRATION, ANT, ENTERPRISE MANAGER OPS CENTER, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, ORACLE RETAIL STORE INVENTORY MANAGEMENT, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE BANKING LIQUIDITY MANAGEMENT, CATEGORY MANAGEMENT PLANNING & OPTIMIZATION, ORACLE FLEXCUBE PRIVATE BANKING, ORACLE FLEXCUBE INVESTOR SERVICING, ORACLE RETAIL SIZE PROFILE OPTIMIZATION, ORACLE FUSION MIDDLEWARE, ORACLE RETAIL INTEGRATION BUS, ORACLE RETAIL REGULAR PRICE OPTIMIZATION, ORACLE REAL-TIME DECISION SERVER, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE RETAIL MACRO SPACE OPTIMIZATION, ORACLE UTILITIES APPLICATIONS, ORACLE RETAIL MERCHANDISE FINANCIAL PLANNING, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE RAPID PLANNING, ORACLE BANKING PLATFORM, ORACLE RETAIL PREDICTIVE APPLICATION SERVER, ORACLE COMMUNICATIONS ASAP, ORACLE RETAIL ITEM PLANNING, ORACLE RETAIL RETURNS MANAGEMENT, ORACLE COMMUNICATIONS METASOLV SOLUTION, ORACLE RETAIL APPLICATIONS, ORACLE RETAIL BACK OFFICE, ORACLE SUPPLY CHAIN, ORACLE BANKING ENTERPRISE COLLECTIONS, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), ORACLE BUSINESS PROCESS MANAGEMENT SUITE, ORACLE HEALTH SCIENCES INFORMATION MANAGER, ORACLE ENTERPRISE REPOSITORY, ORACLE RETAIL CENTRAL OFFICE, ORACLE COMMUNICATIONS, ORACLE RETAIL SERVICE BACKBONE, ORACLE RETAIL REPLENISHMENT OPTIMIZATION, ORACLE ENDECA INFORMATION DISCOVERY STUDIO, ORACLE RETAIL EXTRACT TRANSFORM AND LOAD, ORACLE RETAIL DATA EXTRACTOR FOR MERCHANDISING

References

URLTags
https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c@%3Cdev.creadur.apache.org%3E WEB
https://lists.apache.org/thread.html/rb860063819b9c0990e1fbce29d83f4554766fe5a05e3b3939736bf2b@%3Ccommits.myfaces.apache.org%3E WEB
https://lists.apache.org/thread.html/rb8ec556f176c83547b959150e2108e2ddf1d61224295941908b0a81f@%3Cannounce.apache.org%3E WEB
https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a@%3Cdev.creadur.apache.org%3E WEB
https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea@%3Cdev.ant.apache.org%3E WEB
https://lists.apache.org/thread.html/rc89e491b5b270fb40f1210b70554527b737c217ad2e831b643ead6bc@%3Cuser.ant.apache.org%3E WEB
https://lists.apache.org/thread.html/rce099751721c26a8166d8b6578293820832831a0b2cb8d93b8efa081@%3Cnotifications.groovy.apache.org%3E WEB
https://lists.apache.org/thread.html/rd7dda48ff835f4d0293949837d55541bfde3683bd35bd8431e324538@%3Cdev.creadur.apache.org%3E WEB
https://lists.apache.org/thread.html/rda80ac59119558eaec452e58ddfac2ccc9211da1c65f7927682c78b1@%3Cdev.creadur.apache.org%3E WEB
https://lists.apache.org/thread.html/rdaa9c51d5dc6560c9d2b3f3d742c768ad0705e154041e574a0fae45c@%3Cnotifications.groovy.apache.org%3E WEB

Timeline
Published2020-05-14By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.