Read the docs
TI-2020-09639 Aliases CVE-2020-11979GHSA-f62v-xpxf-3v68

Injection in Apache Ant

Priority MEDIUM 49CWE-379Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 3 fixed, 13 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07757 94th percentileScored 2026-11-08
Fix Partial org.apache.ant:ant (Maven): 1.10.9Red Hat: 3 advisoriesRed Hat: 3 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache AntApache Ant 1.10.8—No fix listedCNA
—org.apache.ant:ant (Maven)before 1.10.91.10.9Patch availableGHSA-f62v-xpxf-3v68
  • Apache Ant Vendor— Affected Apache Ant 1.10.8 Fixed in — No fix listed CNA
  • org.apache.ant:ant (Maven) Vendor— Affected before 1.10.9 Fixed in 1.10.9 Patch available GHSA-f62v-xpxf-3v68

CPE configurations NVD · 70

CPEVersionsRoleVendor
cpe:2.3:a:apache:ant:1.10.8:*:*:*:*:*:*:*1.10.8VulnerableApache
cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*before 6.8.0Vulnerablegradle
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*11.1.2.4.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
  • cpe:2.3:a:apache:ant:1.10.8:*:*:*:*:*:*:* Versions 1.10.8 Vulnerable ·Apache
  • cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:* Versions before 6.8.0 Vulnerable ·gradle
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* Versions 11.1.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
Show 60 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableOracle
cpe:2.3:a:oracle:banking_treasury_management:14.4:*:*:*:*:*:*:*14.4VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*3.2.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*11.1.1.7.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.6 – 8.0.9VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*16.2.0 – 16.2.11; 17.12.0 – 17.12.9VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:*3.2.0.0VulnerableOracle
cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_category_management_planning_\&_optimization:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:*20.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:14.1.3:*:*:*:*:*:*:*14.1.3VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_item_planning:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_macro_space_optimization:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_merchandise_financial_planning:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:14.1.3.2:*:*:*:*:*:*:*14.1.3.2VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_regular_price_optimization:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_replenishment_optimization:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:14.1.3:*:*:*:*:*:*:*14.1.3VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.9:*:*:*:*:*:*:*14.1.3.9VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.0:*:*:*:*:*:*:*15.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:*15.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*16.0.6VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*17.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*18.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*19.0.2VulnerableOracle
cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*8.5.1VulnerableOracle
cpe:2.3:a:oracle:storagetek_tape_analytics:2.4:*:*:*:*:*:*:*2.4VulnerableOracle
cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*before 11.2.2.8.27VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:*4.3.0.5.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*4.3.0.6.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*4.4.0.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*4.4.0.2.0VulnerableOracle
  • cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_treasury_management:14.4:*:*:*:*:*:*:* Versions 14.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:* Versions 3.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 16.2.0 – 16.2.11; 17.12.0 – 17.12.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:* Versions 3.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_category_management_planning_\&_optimization:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:* Versions 20.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_item_planning:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_macro_space_optimization:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandise_financial_planning:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_regular_price_optimization:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_replenishment_optimization:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.9:*:*:*:*:*:*:* Versions 14.1.3.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.0:*:*:*:*:*:*:* Versions 15.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:* Versions 15.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:storagetek_tape_analytics:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 11.2.2.8.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:* Versions 4.3.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* Versions 4.3.0.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-f62v-xpxf-3v68 org.apache.ant:ant (Maven) Fixed in 1.10.9 Advisory →

Red Hat 3 advisories

  • RHSA-2021:0637 Released 2021-03-03 · Red Hat rating Important
    OpenShift Container Platform 3.11.394 bug fix and security update
    • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1612862361-1.el7, jenkins-2.263.3.1612433584-1.el7, python-rsa-4.5-3.el7 +1
  • RHSA-2021:0429 Released 2021-03-03 · Red Hat rating Important
    OpenShift Container Platform 4.5.33 packages and security update
    • Red Hat OpenShift Container Platform 4.5 conmon-2:2.0.21-1.rhaos4.5.el7, conmon-2:2.0.21-1.rhaos4.5.el8, jenkins-2.263.3.1612434332-1.el7 +12
  • RHSA-2021:0423 Released 2021-02-17 · Red Hat rating Important
    OpenShift Container Platform 4.6.17 security and packages update
    • Red Hat OpenShift Container Platform 4.6 jenkins-2.263.3.1612434510-1.el8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Decision Manager 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:0637
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2021:0429
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:0423
Not affected: 6 products
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Single Sign-On 7
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11979
  2. 2026-10-03 Alias added: GHSA-f62v-xpxf-3v68
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 6

Advisory 7

Other 19

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences