Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: this candidate is not about any specific product, protocol, or design, that falls into the scope of the assigning CNA. Notes: None

This update for ant fixes the following issues :

Security issue fixed :

  - CVE-2018-10886: Fixed a path traversal vulnerability in     malformed zip file paths, which allowed arbitrary file     writes and could potentially lead to code execution     (bsc#1100053). 

Non-security issues fixed :

  - Add rhino to the ant-apache-bsf optional tasks     (bsc#1134001).

  - Remove jakarta-commons-logging dependencies     (bsc#1133997).

  - Use apache-commons-logging in optional tasks

This update was imported from the SUSE:SLE-15:Update update project.

This update for ant fixes the following issues :

Security issue fixed :

  - CVE-2018-10886: Fixed a path traversal vulnerability in     malformed zip file paths, which allowed arbitrary file     writes and could potentially lead to code execution     (bsc#1100053)

This update was imported from the SUSE:SLE-15:Update update project.

It was discovered that Ant's unzip and untar targets permit the extraction of files outside the target directory. A crafted zip or tar file submitted to an Ant build could create or overwrite arbitrary files with the privileges of the user running Ant.(CVE-2018-10886)

Danny Grander reported that the unzip and untar tasks in ant, a Java based build tool like make, allow the extraction of files outside a target directory. An attacker can take advantage of this flaw by submitting a specially crafted Zip or Tar archive to an ant build to overwrite any file writable by the user running ant.

unzip and untar target tasks in ant allows the extraction of files outside the target directory. A crafted zip or tar file submitted to an Ant build could create or overwrite arbitrary files with the privileges of the user running Ant.

For Debian 8 'Jessie', these problems have been fixed in version 1.9.4-3+deb8u1.

We recommend that you upgrade your ant packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
136886	openSUSE Security Update : ant (openSUSE-2020-703)	Nessus	SuSE Local Security Checks	high
123315	openSUSE Security Update : ant (openSUSE-2019-729)	Nessus	SuSE Local Security Checks	medium
117819	openSUSE Security Update : ant (openSUSE-2018-1057)	Nessus	SuSE Local Security Checks	medium
111338	Amazon Linux AMI : ant (ALAS-2018-1047)	Nessus	Amazon Linux Local Security Checks	high
111317	Debian DSA-4255-1 : ant - security update	Nessus	Debian Local Security Checks	high
111168	Debian DLA-1431-1 : ant security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10886

No Score

Tenable Plugins

high

medium

medium

high

high

high