Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qNzVyLXZmNjQtNnJyaM4AAxzY

RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.

Permalink: https://github.com/advisories/GHSA-j75r-vf64-6rrh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNzVyLXZmNjQtNnJyaM4AAxzY
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 1 year ago
Updated: 6 months ago

CVSS Score: 3.3
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-j75r-vf64-6rrh, CVE-2023-0481
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-0481
• https://github.com/quarkusio/quarkus/pull/30694
• https://github.com/quarkusio/quarkus/commit/95d5904f7cf18c8165b97d8ca03b203d7f69c17e
• https://github.com/advisories/GHSA-j75r-vf64-6rrh

Repository: https://github.com/quarkusio/quarkus
Blast Radius: 6.8

Affected Packages