openSUSE-SU-2026:21891-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21891-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21891-1

Upstream

CVE (3)

Related

CVE (3)

Published

2026-09-20T14:11:16Z

Modified

2026-09-25T18:23:11Z

Summary

Security update for ant

Details

This update for ant fixes the following issues:

CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats (bsc#1188469).
CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection (bsc#1246873).
CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).

Changes for ant:

Upgrade to version 1.10.18

Breaking changes:

the default value for 's useSecureDataChannel has been changed to true which means using ftps now also tries to use an encrypted data channel by default.
the and tasks have new allowFilesToEscapeDest attributes. When set to false - which is the default - the tasks will not download files or create directories outside the designated destination directory when downloading from the remote server. In the unlikely case you need the old bahaviour of writing outside the destination directory you must set the value to true explicitly.

Other changes:

when using the SOURCE_DATE_EPOCH environment variable to set the time for the timezone will now be set to UTC for DSTAMP, TSTAMP and TODAY. This also applies to nested formats where the locale now also defaults to en_US unless it (or the timezone) have been set explicitly.
Upgraded the jakarta.mail dependency to 2.0.2 because of bsc#1246873, CVE-2025-7962.
the SOURCE_DATE_EPOCH environment variable as well as the magic ant.tstamp.now and ant.tstamp.now.iso properties now also affect the timestamp added to a properties file written by - but only if jdkproperties has its default value of false.
a new method getBuildDate in Project can now be used to calculate a notion of a "build date" that consults the SOURCE_DATE_EPOCH environment variable as well as the magic ant.tstamp.now and ant.tstamp.now.iso properties in this order which you can use if you want to obtain a reproducible timestamp in tasks you write yourself.
The "record" task now has a new "relativeToBaseDir" attribute, which can be set to "yes" or "no", to control where the recorder's file gets created. In the absence of this attribute, if the "name" of the recorder was a relative path, then the recorder would create the file in the current working directory of the process. With this new attribute, the recorder can be configured to create that file in the basedir of the project.

Fixed bugs:

When running with "microsoft" Java, Ant used to hardcode the "$JAVA_HOME/Packages" directory in the runtime Paths for certain tasks. The JDK shipped by Microsoft no longer contains that directory (for several decades now). As a result, when running with "microsoft" Java, an exception would be raised due to the missing directory. This has now been fixed and Ant no longer adds that directory to the Java runtime Paths.
Inaccuracies in the documentation of the "record" task have been fixed.
with "enableMultipleMappings" set to "true" threw a NullPointerException if the mapper didn't apply to one of the resources. Unmapped resources are now omitted from the collection.

Changes of version 1.10.17

The JavaEnvUtils and FileUtils classes statically depend on each other since Ant 1.10.16 making it impossible to load JavaEnvUtils without loading FileUtils first causing NullPointerException for programmatic use on Windows. This affected Eclipse and may also affect other projects using Ant as a library. The classes can now be loaded independently again.

Changes of version 1.10.16

now uses the same logic to compare file timestamps when determining whether a target file is out-of-date with respect to the source file or stylesheet that most other tasks use. This means it will assume a default timestamp granularity that depends on the current operating system. A new granularity attribute allows you to override the assumed granularity. Under certain edge cases this means xslt will now not process files it would have processed before (when the timestamps of source or stylesheet are very close or even equal to the timestamp of the target). In this case you can set granularity to 0 to get back to the behavior of 1.10.15.
the task as well as MailLogger will now check the server identity as specified by RFC 2595 when JavaMail is used in combination with TLS (plain TLS or StartTLS). The check can be disabled with a new MailLogger property MailLogger.tls.checkserveridentity or a new task attribute checkServerIdentity.
Ant now recognizes Windows junctions and treats them just like symbolic links in general. With this builds on Windows that use followSymlinks="false" and rely on Ant following Windows junctions will break. In order to get the old behavior you need to set followSymlinks to true and exclude real symbolic links via the selector.
now properly handles IPv6 addresses as hostnames.
javac task has been fixed to generate the "-classpath" option only when there are any classpath elements present.
URLResource#getName could strip the first character of a resource path even if it was not a file separator.
ant.bat now exits with a non-zero exit code if ANT_HOME is not set.
A regression in ftp task caused some files to not be downloaded. That has been fixed now.
Ant will no longer set a java.lang.SecurityManager at runtime if the "java.security.manager" system property is set to "disallow".
and MailLogger can now enforce the use of STARTLS rather than silently fall back to unencrypted authentication via a new MailLogger property and a new task attribute.
added a Windows specific task that can be used to create hard links, symbolic links and junctions.
added that can be used delete symbolic links or Windows junctions. For symbolic links this duplicates what <symlink action="delete" ...> does - it has been introduced to handle symlinks and junctions via a single API.
added condition that evaluates to true if the current Ant process can create symbolic links.
added file selector which only selects directories that are Windows junctions.
added a new actOnLinkTargets attribute to to control whether the permissions apply to a symbolic link or Windows junction or the target of the respective links. The old behavior of changing the link's target remains as default.
a new combination of attributes allows to mask sensitive data specified for the command line to execute.
just omit completely the Created-By if SOURCE_DATE_EPOCH is set

has a new attribute authenticateOnRedirect that can be used to prevent Ant from sending the configured credentials builds that rely on credentials being used on the redirected
the PropertyEnumerator change introduced in 1.10.9 proved to be not fully backwards compatible when combined with certain
may leak connections when trying to preserve the last modified timestamps of files transferred recursively from a environment variable value to an incorrect date. This has now
fetch.xml didn't set up non-default repositories propery and build script would change permissions on unrelated files in the destination directory. This is now fixed and such unrelated files in the destination directory will be left
parsing tar entries with multiple NUL bytes in their name
loadresource might log warnings even though quiet was set to repackaged Jakarta Mail package rather than javax Mail.
org.apache.tools.ant.BuildLogger now has a new method getMessageOutputLevel() which returns the currently set CVE-2021-36374, bsc#1188469 Excessive memory allocation when reading a specially

Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
The implementation of AntClassLoader#findResources() has been changed to optimize

Update to ant 1.8.2

References

Affected packages

openSUSE:Leap 16.0 / ant

Package

Name: ant
Purl: pkg:rpm/opensuse/ant&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.18-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "ant":  "1.10.18-160000.1.1",
            "ant-antlr":  "1.10.18-160000.1.1",
            "ant-apache-bcel":  "1.10.18-160000.1.1",
            "ant-apache-bsf":  "1.10.18-160000.1.1",
            "ant-apache-log4j":  "1.10.18-160000.1.1",
            "ant-apache-oro":  "1.10.18-160000.1.1",
            "ant-apache-regexp":  "1.10.18-160000.1.1",
            "ant-apache-resolver":  "1.10.18-160000.1.1",
            "ant-apache-xalan2":  "1.10.18-160000.1.1",
            "ant-commons-logging":  "1.10.18-160000.1.1",
            "ant-commons-net":  "1.10.18-160000.1.1",
            "ant-imageio":  "1.10.18-160000.1.1",
            "ant-jakartamail":  "1.10.18-160000.1.1",
            "ant-javamail":  "1.10.18-160000.1.1",
            "ant-jdepend":  "1.10.18-160000.1.1",
            "ant-jmf":  "1.10.18-160000.1.1",
            "ant-jsch":  "1.10.18-160000.1.1",
            "ant-junit":  "1.10.18-160000.1.1",
            "ant-junit5":  "1.10.18-160000.1.1",
            "ant-manual":  "1.10.18-160000.1.1",
            "ant-scripts":  "1.10.18-160000.1.1",
            "ant-swing":  "1.10.18-160000.1.1",
            "ant-testutil":  "1.10.18-160000.1.1",
            "ant-xz":  "1.10.18-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21891-1.json"

openSUSE:Leap 16.0 / ant-antlr

Package

Name: ant-antlr
Purl: pkg:rpm/opensuse/ant-antlr&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.18-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "ant":  "1.10.18-160000.1.1",
            "ant-antlr":  "1.10.18-160000.1.1",
            "ant-apache-bcel":  "1.10.18-160000.1.1",
            "ant-apache-bsf":  "1.10.18-160000.1.1",
            "ant-apache-log4j":  "1.10.18-160000.1.1",
            "ant-apache-oro":  "1.10.18-160000.1.1",
            "ant-apache-regexp":  "1.10.18-160000.1.1",
            "ant-apache-resolver":  "1.10.18-160000.1.1",
            "ant-apache-xalan2":  "1.10.18-160000.1.1",
            "ant-commons-logging":  "1.10.18-160000.1.1",
            "ant-commons-net":  "1.10.18-160000.1.1",
            "ant-imageio":  "1.10.18-160000.1.1",
            "ant-jakartamail":  "1.10.18-160000.1.1",
            "ant-javamail":  "1.10.18-160000.1.1",
            "ant-jdepend":  "1.10.18-160000.1.1",
            "ant-jmf":  "1.10.18-160000.1.1",
            "ant-jsch":  "1.10.18-160000.1.1",
            "ant-junit":  "1.10.18-160000.1.1",
            "ant-junit5":  "1.10.18-160000.1.1",
            "ant-manual":  "1.10.18-160000.1.1",
            "ant-scripts":  "1.10.18-160000.1.1",
            "ant-swing":  "1.10.18-160000.1.1",
            "ant-testutil":  "1.10.18-160000.1.1",
            "ant-xz":  "1.10.18-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21891-1.json"

openSUSE:Leap 16.0 / ant-junit

Package

Name: ant-junit
Purl: pkg:rpm/opensuse/ant-junit&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.18-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "ant":  "1.10.18-160000.1.1",
            "ant-antlr":  "1.10.18-160000.1.1",
            "ant-apache-bcel":  "1.10.18-160000.1.1",
            "ant-apache-bsf":  "1.10.18-160000.1.1",
            "ant-apache-log4j":  "1.10.18-160000.1.1",
            "ant-apache-oro":  "1.10.18-160000.1.1",
            "ant-apache-regexp":  "1.10.18-160000.1.1",
            "ant-apache-resolver":  "1.10.18-160000.1.1",
            "ant-apache-xalan2":  "1.10.18-160000.1.1",
            "ant-commons-logging":  "1.10.18-160000.1.1",
            "ant-commons-net":  "1.10.18-160000.1.1",
            "ant-imageio":  "1.10.18-160000.1.1",
            "ant-jakartamail":  "1.10.18-160000.1.1",
            "ant-javamail":  "1.10.18-160000.1.1",
            "ant-jdepend":  "1.10.18-160000.1.1",
            "ant-jmf":  "1.10.18-160000.1.1",
            "ant-jsch":  "1.10.18-160000.1.1",
            "ant-junit":  "1.10.18-160000.1.1",
            "ant-junit5":  "1.10.18-160000.1.1",
            "ant-manual":  "1.10.18-160000.1.1",
            "ant-scripts":  "1.10.18-160000.1.1",
            "ant-swing":  "1.10.18-160000.1.1",
            "ant-testutil":  "1.10.18-160000.1.1",
            "ant-xz":  "1.10.18-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21891-1.json"

openSUSE:Leap 16.0 / ant-junit5

Package

Name: ant-junit5
Purl: pkg:rpm/opensuse/ant-junit5&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.18-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "ant":  "1.10.18-160000.1.1",
            "ant-antlr":  "1.10.18-160000.1.1",
            "ant-apache-bcel":  "1.10.18-160000.1.1",
            "ant-apache-bsf":  "1.10.18-160000.1.1",
            "ant-apache-log4j":  "1.10.18-160000.1.1",
            "ant-apache-oro":  "1.10.18-160000.1.1",
            "ant-apache-regexp":  "1.10.18-160000.1.1",
            "ant-apache-resolver":  "1.10.18-160000.1.1",
            "ant-apache-xalan2":  "1.10.18-160000.1.1",
            "ant-commons-logging":  "1.10.18-160000.1.1",
            "ant-commons-net":  "1.10.18-160000.1.1",
            "ant-imageio":  "1.10.18-160000.1.1",
            "ant-jakartamail":  "1.10.18-160000.1.1",
            "ant-javamail":  "1.10.18-160000.1.1",
            "ant-jdepend":  "1.10.18-160000.1.1",
            "ant-jmf":  "1.10.18-160000.1.1",
            "ant-jsch":  "1.10.18-160000.1.1",
            "ant-junit":  "1.10.18-160000.1.1",
            "ant-junit5":  "1.10.18-160000.1.1",
            "ant-manual":  "1.10.18-160000.1.1",
            "ant-scripts":  "1.10.18-160000.1.1",
            "ant-swing":  "1.10.18-160000.1.1",
            "ant-testutil":  "1.10.18-160000.1.1",
            "ant-xz":  "1.10.18-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21891-1.json"