Bug 1953024 (CVE-2021-28168) - CVE-2021-28168 jersey: Local information disclosure via system temporary directory
Summary: CVE-2021-28168 jersey: Local information disclosure via system temporary dire...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-28168
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1953025
Blocks: 1953026
TreeView+ depends on / blocked
 
Reported: 2021-04-23 18:26 UTC by Pedro Sampaio
Modified: 2022-03-23 08:22 UTC (History)
51 users (show)

Fixed In Version: jersey 2.34, jersey 3.0.2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-08-19 09:34:58 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3225 0 None None None 2021-08-19 07:18:46 UTC
Red Hat Product Errata RHSA-2022:1013 0 None None None 2022-03-22 15:33:53 UTC
Red Hat Product Errata RHSA-2022:1029 0 None None None 2022-03-23 08:22:41 UTC

Description Pedro Sampaio 2021-04-23 18:26:23 UTC 
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

References:

https://github.com/eclipse-ee4j/jersey/security/advisories/GHSA-c43q-5hpj-4crv
https://github.com/eclipse-ee4j/jersey/pull/4712
Comment 1 Pedro Sampaio 2021-04-23 18:27:02 UTC 
Created jersey tracking bugs for this issue:

Affects: fedora-all [bug 1953025]
Comment 2 Anten Skrabec 2021-04-30 03:47:22 UTC 
Statement:

Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.
Comment 10 errata-xmlrpc 2021-08-19 07:18:43 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Streams 1.8.0

Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225
Comment 11 Product Security DevOps Team 2021-08-19 09:34:58 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-28168
Comment 12 errata-xmlrpc 2022-03-22 15:33:50 UTC 
This issue has been addressed in the following products:

  RHINT Camel-Q 2.2.1

Via RHSA-2022:1013 https://access.redhat.com/errata/RHSA-2022:1013
Comment 13 errata-xmlrpc 2022-03-23 08:22:37 UTC 
This issue has been addressed in the following products:

  RHINT Camel-K 1.6.4

Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029
Note You need to log in before you can comment on or make changes to this bug.