Bug 2215229 (CVE-2023-2976) - CVE-2023-2976 guava: insecure temporary directory creation
Summary: CVE-2023-2976 guava: insecure temporary directory creation
Keywords:
Status: NEW
Alias: CVE-2023-2976
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Sayan Biswas
QA Contact:
URL:
Whiteboard:
Depends On: 2232210 2215230 2215231 2215232 2232209
Blocks: 2215233
TreeView+ depends on / blocked
 
Reported: 2023-06-15 06:22 UTC by Sandipan Roy
Modified: 2024-04-03 03:50 UTC (History)
127 users (show)

Fixed In Version: guava 32.0.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:5165 0 None None None 2023-09-14 09:52:20 UTC
Red Hat Product Errata RHSA-2023:5491 0 None None None 2023-10-05 22:37:41 UTC
Red Hat Product Errata RHSA-2023:7637 0 None None None 2023-12-04 17:57:25 UTC
Red Hat Product Errata RHSA-2023:7638 0 None None None 2023-12-04 17:59:16 UTC
Red Hat Product Errata RHSA-2023:7639 0 None None None 2023-12-04 17:56:50 UTC
Red Hat Product Errata RHSA-2023:7641 0 None None None 2023-12-04 18:02:27 UTC
Red Hat Product Errata RHSA-2023:7678 0 None None None 2023-12-06 23:30:50 UTC
Red Hat Product Errata RHSA-2023:7700 0 None None None 2023-12-07 14:26:49 UTC
Red Hat Product Errata RHSA-2024:0777 0 None None None 2024-02-12 10:25:32 UTC
Red Hat Product Errata RHSA-2024:0778 0 None None None 2024-02-12 10:37:06 UTC
Red Hat Product Errata RHSA-2024:0798 0 None None None 2024-02-13 16:53:49 UTC
Red Hat Product Errata RHSA-2024:0799 0 None None None 2024-02-13 16:52:32 UTC
Red Hat Product Errata RHSA-2024:0800 0 None None None 2024-02-13 16:53:03 UTC
Red Hat Product Errata RHSA-2024:0801 0 None None None 2024-02-13 16:54:19 UTC
Red Hat Product Errata RHSA-2024:0804 0 None None None 2024-02-13 17:08:25 UTC
Red Hat Product Errata RHSA-2024:1027 0 None None None 2024-02-28 18:14:17 UTC

Description Sandipan Roy 2023-06-15 06:22:33 UTC
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.



https://github.com/google/guava/issues/2575

Comment 12 Patrick Del Bello 2023-08-15 18:31:03 UTC
Created guava tracking bugs for this issue:

Affects: fedora-37 [bug 2232209]
Affects: fedora-38 [bug 2232210]

Comment 16 errata-xmlrpc 2023-09-14 09:52:12 UTC
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.5.0

Via RHSA-2023:5165 https://access.redhat.com/errata/RHSA-2023:5165

Comment 18 Catherine_H 2023-09-27 08:45:02 UTC
Hi Team,

Customer reported this CVE affected image ubi8/openjdk-17:1.16-2. Do we have a plan to fix the CVE in this image?
Any update will be appreciated.

Image: https://catalog.redhat.com/software/containers/ubi8/openjdk-17/618bdbf34ae3739687568813?tag=1.16-2&push_date=1690216094000

Best Regards,
Catherine

Comment 20 errata-xmlrpc 2023-10-05 22:37:33 UTC
This issue has been addressed in the following products:

  AMQ Broker 7.11.2

Via RHSA-2023:5491 https://access.redhat.com/errata/RHSA-2023:5491

Comment 21 errata-xmlrpc 2023-12-04 17:56:43 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2023:7639 https://access.redhat.com/errata/RHSA-2023:7639

Comment 22 errata-xmlrpc 2023-12-04 17:57:17 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2023:7637 https://access.redhat.com/errata/RHSA-2023:7637

Comment 23 errata-xmlrpc 2023-12-04 17:59:09 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2023:7638 https://access.redhat.com/errata/RHSA-2023:7638

Comment 24 errata-xmlrpc 2023-12-04 18:02:19 UTC
This issue has been addressed in the following products:

  EAP 7.4.14

Via RHSA-2023:7641 https://access.redhat.com/errata/RHSA-2023:7641

Comment 25 errata-xmlrpc 2023-12-06 23:30:43 UTC
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.6.0

Via RHSA-2023:7678 https://access.redhat.com/errata/RHSA-2023:7678

Comment 26 errata-xmlrpc 2023-12-07 14:26:40 UTC
This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.13.9

Via RHSA-2023:7700 https://access.redhat.com/errata/RHSA-2023:7700

Comment 28 errata-xmlrpc 2024-02-12 10:25:25 UTC
This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.14

Via RHSA-2024:0777 https://access.redhat.com/errata/RHSA-2024:0777

Comment 29 errata-xmlrpc 2024-02-12 10:36:58 UTC
This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.12

Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778

Comment 30 errata-xmlrpc 2024-02-13 16:52:25 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 8

Via RHSA-2024:0799 https://access.redhat.com/errata/RHSA-2024:0799

Comment 31 errata-xmlrpc 2024-02-13 16:52:54 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 9

Via RHSA-2024:0800 https://access.redhat.com/errata/RHSA-2024:0800

Comment 32 errata-xmlrpc 2024-02-13 16:53:41 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 7

Via RHSA-2024:0798 https://access.redhat.com/errata/RHSA-2024:0798

Comment 33 errata-xmlrpc 2024-02-13 16:54:11 UTC
This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2024:0801 https://access.redhat.com/errata/RHSA-2024:0801

Comment 34 errata-xmlrpc 2024-02-13 17:08:16 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2024:0804 https://access.redhat.com/errata/RHSA-2024:0804

Comment 35 errata-xmlrpc 2024-02-28 18:14:08 UTC
This issue has been addressed in the following products:

  MTA-6.2-RHEL-9
  MTA-6.2-RHEL-8

Via RHSA-2024:1027 https://access.redhat.com/errata/RHSA-2024:1027

Comment 36 Paramvir jindal 2024-04-03 03:50:40 UTC
Marking EAP-8 as not affected because EAP 8 GA was released with the fixed version.


Note You need to log in before you can comment on or make changes to this bug.