[ GLSA 202011-18 ] Apache Ant

[GLSA]

Gentoo Linux Security Advisory

Title: Apache Ant: Insecure temporary file (GLSA 202011-18)
Severity: normal
Exploitable: local
Date: 2020-11-16
Bug(s): #745768
ID: 202011-18

Synopsis

Apache Ant uses various insecure temporary files possibly allowing
local code execution.


Background

Ant is a Java-based build tool similar to ‘make’ that uses XML
configuration files.


Affected Packages

Package: dev-java/ant
Vulnerable: < 1.10.9
Unaffected: >= 1.10.9
Architectures: All supported architectures


Description

A previous fix for a security vulnerability involving insecure temporary
files has been found to be incomplete.


Impact

A local attacker could perform symlink attacks to overwrite arbitrary
files with the privileges of the user running the application.


Workaround

There is no known workaround at this time.

Resolution

All Apache Ant users should upgrade to the latest version: