Bug 723086 – <dev-java/ant-1.10.8: Insecure temporary file(s) (CVE-2020-1945)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2020-05-14 18:52:11 UTC]

Description:
"Apache Ant uses the default temporary directory identified by the Java
system property java.io.tmpdir for several tasks and may thus leak
sensitive information. The fixcrlf and replaceregexp tasks also copy
files from the temporary directory back into the build tree allowing an
attacker to inject modified source files into the build process."

Mitigation:
"Ant users of versions 1.1 to 1.9.14 and 1.10.0 to 1.10.7 should set the
java.io.tmpdir system property to point to a directory only readable and
writable by the current user prior to running Ant.

Users of versions 1.9.15 and 1.10.8 can use the Ant property ant.tmpfile
instead. Users of Ant 1.10.8 can rely on Ant protecting the temporary
files if the underlying filesystem allows it, but we still recommend
using a private temporary directory instead."

[Comment 1 Sam James 2020-05-14 18:52:54 UTC]

@maintainer(s), a bump to 1.10.8 may be easiest given it's in the same series?

[Comment 2 Miroslav Šulc 2020-07-05 11:25:50 UTC]

i just did the bump. if it is not urgent, i'd wait at least few days before stabilization is requested to catch any issues. i already prepared the list of the packages that will have to be stabilized so then we can just add the archs and stabilization keyword.

[Comment 3 Sam James 2020-07-18 20:49:54 UTC]

(In reply to Miroslav Šulc from comment #2)
> i just did the bump. if it is not urgent, i'd wait at least few days before
> stabilization is requested to catch any issues. i already prepared the list
> of the packages that will have to be stabilized so then we can just add the
> archs and stabilization keyword.

Thanks. How're we looking now?

[Comment 4 Miroslav Šulc 2020-07-19 10:20:00 UTC]

please stabilize

[Comment 5 Sam James 2020-07-19 11:30:40 UTC]

(In reply to Miroslav Šulc from comment #4)
> please stabilize

Thank you!

[Comment 6 Sam James 2020-07-19 13:38:28 UTC]

x86 stable

[Comment 7 Sam James 2020-07-19 13:43:20 UTC]

amd64 stable

[Comment 8 Sam James 2020-07-19 15:19:33 UTC]

arm64 stable

[Comment 9 Sam James 2020-07-19 21:36:06 UTC]

ppc64 stable. Please cleanup.

[Comment 10 Larry the Git Cow 2020-07-20 09:06:20 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6cde1c726ba0cf23fbf05c4ef5dcf918b37c94b9

commit 6cde1c726ba0cf23fbf05c4ef5dcf918b37c94b9
Author:     Miroslav Šulc <[e-mail]>
AuthorDate: 2020-07-20 08:56:15 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2020-07-20 09:06:04 +0000

    dev-java/ant: removed old and vulnerable
    
    Bug: https://bugs.gentoo.org/723086
    Package-Manager: Portage-3.0.0, Repoman-2.3.23
    Signed-off-by: Miroslav Šulc <[e-mail]>

 dev-java/ant/ant-1.10.7.ebuild | 47 ------------------------------------------
 1 file changed, 47 deletions(-)

[Comment 11 Sam James 2020-07-26 02:19:47 UTC]

Thanks!

[Comment 12 GLSAMaker/CVETool Bot 2020-07-27 00:32:36 UTC]

This issue was resolved and addressed in
 GLSA 202007-34 at https://security.gentoo.org/glsa/202007-34
by GLSA coordinator Sam James (sam_c).