CVE-2020-11979: ant 1.10.8; +37 more affected products

Affected technology

ant · 1.10.8
apache

gradle · before 6.8.0 (exclusive)
gradle

fedora · 31
fedoraproject

fedora · 32
fedoraproject

fedora · 33
fedoraproject

agile engineering data management · 6.2.1.0
oracle

api gateway · 11.1.2.4.0
oracle

banking platform · 2.4.0
oracle

banking platform · 2.4.1
oracle

banking platform · 2.6.2
oracle

banking platform · 2.7.0
oracle

banking platform · 2.7.1
oracle

banking platform · 2.8.0
oracle

banking treasury management · 14.4
oracle

communications unified inventory management · 7.4.0
oracle

communications unified inventory management · 7.4.1
oracle

data integrator · 12.2.1.3.0
oracle

data integrator · 12.2.1.4.0
oracle

endeca information discovery studio · 3.2.0.0
oracle

enterprise repository · 11.1.1.7.0
oracle

financial services analytical applications infrastructure · from 8.0.6 (inclusive), through 8.0.9 (inclusive)
oracle

financial services analytical applications infrastructure · 8.1.0
oracle

financial services analytical applications infrastructure · 8.1.1
oracle

flexcube private banking · 12.0.0
oracle

flexcube private banking · 12.1.0
oracle

primavera gateway · from 16.2.0 (inclusive), through 16.2.11 (inclusive)
oracle

primavera gateway · from 17.12.0 (inclusive), through 17.12.9 (inclusive)
oracle

primavera unifier · from 17.7 (inclusive), through 17.12 (inclusive)
oracle

primavera unifier · 16.1
oracle

primavera unifier · 16.2
oracle

primavera unifier · 18.8
oracle

primavera unifier · 19.12
oracle

primavera unifier · 20.12
oracle

real-time decision server · 3.2.0.0
oracle

real-time decision server · 11.1.1.9.0
oracle

retail advanced inventory planning · 14.1
oracle

retail assortment planning · 16.0.3
oracle

retail category management planning & optimization · 16.0.3
oracle

retail eftlink · 19.0.1
oracle

retail eftlink · 20.0.0
oracle

retail financial integration · 14.1.3
oracle

retail financial integration · 15.0.3
oracle

retail financial integration · 16.0.3
oracle

retail integration bus · 15.0.3
oracle

retail item planning · 16.0.3
oracle

retail macro space optimization · 16.0.3
oracle

retail merchandise financial planning · 16.0.3
oracle

retail merchandising system · 14.1.3.2
oracle

retail merchandising system · 16.0.3
oracle

retail predictive application server · 14.1
oracle

retail regular price optimization · 16.0.3
oracle

retail replenishment optimization · 16.0.3
oracle

retail service backbone · 14.1.3
oracle

retail service backbone · 15.0.3
oracle

retail service backbone · 16.0.3
oracle

retail size profile optimization · 16.0.3
oracle

retail store inventory management · 14.1.3.9
oracle

retail store inventory management · 15.0.3.0
oracle

retail store inventory management · 16.0.3.0
oracle

retail xstore point of service · 15.0.4
oracle

retail xstore point of service · 16.0.6
oracle

retail xstore point of service · 17.0.4
oracle

retail xstore point of service · 18.0.3
oracle

retail xstore point of service · 19.0.2
oracle

storagetek acsls · 8.5.1
oracle

storagetek tape analytics · 2.4
oracle

timesten in-memory database · before 11.2.2.8.27 (exclusive)
oracle

utilities framework · 4.3.0.5.0
oracle

utilities framework · 4.3.0.6.0
oracle

utilities framework · 4.4.0.0.0
oracle

utilities framework · 4.4.0.2.0
oracle

Apache Ant · Apache Ant 1.10.8
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can inject modified source files into the build process. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and availability impact as none; integrity impact as high.