maven package report

Is org.apache.ant:ant safe?

4 known vulnerabilities, worst severity HIGH.

cvss
7.5

how bad it is if exploited, out of 10

epss
8.0%

chance of exploitation in the next 30 days

xyz score
3.6

CyberXYZ composite, out of 10

fig. 01 — GHSA-f62v-xpxf-3v68, the advisory selected below

// advisories

GHSA-f62v-xpxf-3v68

HIGHCVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Affected
>=0, <6.8.0
Fixed in
1.10.9
Weakness
CWE-74
Published
2021-02-03
Source
github

GHSANVDMITRE

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 01:43 UTC. The most recent advisory here was published 2021-08-02. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is org.apache.ant:ant safe? maven package security report | CyberXYZ