GitStock

google/guava · Security

Information Disclosure in Guava

GHSA ID
GHSA-5mg8-w23w-74h3
CVE ID
CVE-2020-8908
Severity
low
Published
Updated
CVSS
3.3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3
3.3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

CWEs

  • CWE-173 · Improper Handling of Alternate Encoding
  • CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-378 · Creation of Temporary File With Insecure Permissions
  • CWE-732 · Incorrect Permission Assignment for Critical Resource

References