Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03ZzQ1LTRybTYtM21tM84AAz3U

Guava vulnerable to insecure use of temporary directory

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Permalink: https://github.com/advisories/GHSA-7g45-4rm6-3mm3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03ZzQ1LTRybTYtM21tM84AAz3U
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: 9 months ago

CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-7g45-4rm6-3mm3, CVE-2023-2976
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-2976
• https://github.com/google/guava/issues/2575
• https://github.com/google/guava/issues/6532
• https://github.com/google/guava/commit/feb83a1c8fd2e7670b244d5afd23cba5aca43284
• https://github.com/google/guava/releases/tag/v32.0.0
• https://security.netapp.com/advisory/ntap-20230818-0008
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01006.html
• https://github.com/advisories/GHSA-7g45-4rm6-3mm3

Repository: https://github.com/google/guava
Blast Radius: 29.4

Affected Packages