Information Disclosure in Guava
A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-8908US | low3.3 | — | ||
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/google/guavaPACKAGE
- https://github.com/google/guava/commit/feb83a1c8fd2e7670b244d5afd23cba5aca43284WEB
- https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40WEB
- https://github.com/google/guava/issues/4011WEB
- https://github.com/google/guava/issues/4011#issuecomment-1578991974WEB
- https://lists.apache.org/thread.html/r007add131977f4f576c232b25e024249a3d16f66aad14a4b52819d21%40%3Ccommon-issues.hadoop.apache.org%3EWEB
- https://lists.apache.org/thread.html/r007add131977f4f576c232b25e024249a3d16f66aad14a4b52819d21@%3Ccommon-issues.hadoop.apache.org%3EWEB
- https://lists.apache.org/thread.html/r037fed1d0ebde50c9caf8d99815db3093c344c3f651c5a49a09824ce@%3Cdev.drill.apache.org%3EWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan