Summary:

InstallAnywhere 2022 includes ANT 1.10.12 version. Support for Ant 1.9.9 and below versions is deprecated.

Problem:

Several high and medium security vulnerabilities are detected in ANT 1.9.9 and below version.

ANT libraries can be used as dependencies for execution of scripts while executing ‘Execute Ant Script’ action. Execution of custom ant scripts may get impacted and installers consisting of these actions will be vulnerable.

Solution:

InstallAnywhere 2022 includes latest ANT 1.10.12 version for design time and runtime executions. Latest Ant libraries consist most of the functionalities of older Ant.

Few jars shipped with older InstallAnywhere are not available with latest ANT and are obsolete. These jars are removed.

List of removed older ant jars:

• IA_HOME/resource/ant/ant-nodeps.jar
• IA_HOME/resource/ant/ant-xslp.jar
• IA_HOME/resource/ant/ant-xalan1.jar
• IA_HOME/resource/ant/ant-weblogic.jar
• IA_HOME/resource/ant/ant-vaj.jar
• IA_HOME/resource/ant/ant-trax.jar
• IA_HOME/resource/ant/ant-stylebook.jar
• IA_HOME/resource/ant/ant-starteam.jar
• IA_HOME/resource/ant/ant-icontract.jar

If you intend to use the deprecated ant functionalities or libraries, you’d need to use older version of ant libraries. They could be downloaded over the internet and placed in <IA_HOME>/resource/ant folder.

“Execute ANT Script” action Dependencies will list all jars/ libraries and can be added as external jars using “Add jar or zip”.

Note: If older jar files are added as dependencies, the files will be bundled with installer and have security vulnerabilities.