GHSA-5mg8-w23w-74h3

Information Disclosure in Guava

At a glance

Published
Updated
CVE
CVE-2020-8908
Aliases
SNYK-JAVA-COMGOOGLEGUAVA-1015415
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

Affected packages

PackageVersions
Maven · com.google.guava:guavaintroduced 0, fixed 32.0.0-android

References

Sources

SourceLicence
OSV.devCC-BY 4.0 — GitHub Advisory Database