Bug 2215229 (CVE-2023-2976) - CVE-2023-2976 guava: insecure temporary directory creation
Summary: CVE-2023-2976 guava: insecure temporary directory creation
Keywords:
Status: NEW
Alias: CVE-2023-2976
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Sayan Biswas
QA Contact:
URL:
Whiteboard:
Depends On: 2232210 2215230 2215231 2215232 2232209
Blocks: 2215233
TreeView+ depends on / blocked
 
Reported: 2023-06-15 06:22 UTC by Sandipan Roy
Modified: 2024-05-06 14:10 UTC (History)
125 users (show)

Fixed In Version: guava 32.0.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:5165 0 None None None 2023-09-14 09:52:20 UTC
Red Hat Product Errata RHSA-2023:5491 0 None None None 2023-10-05 22:37:41 UTC
Red Hat Product Errata RHSA-2023:7637 0 None None None 2023-12-04 17:57:25 UTC
Red Hat Product Errata RHSA-2023:7638 0 None None None 2023-12-04 17:59:16 UTC
Red Hat Product Errata RHSA-2023:7639 0 None None None 2023-12-04 17:56:50 UTC
Red Hat Product Errata RHSA-2023:7641 0 None None None 2023-12-04 18:02:27 UTC
Red Hat Product Errata RHSA-2023:7678 0 None None None 2023-12-06 23:30:50 UTC
Red Hat Product Errata RHSA-2023:7700 0 None None None 2023-12-07 14:26:49 UTC
Red Hat Product Errata RHSA-2024:0777 0 None None None 2024-02-12 10:25:32 UTC
Red Hat Product Errata RHSA-2024:0778 0 None None None 2024-02-12 10:37:06 UTC
Red Hat Product Errata RHSA-2024:0798 0 None None None 2024-02-13 16:53:49 UTC
Red Hat Product Errata RHSA-2024:0799 0 None None None 2024-02-13 16:52:32 UTC
Red Hat Product Errata RHSA-2024:0800 0 None None None 2024-02-13 16:53:03 UTC
Red Hat Product Errata RHSA-2024:0801 0 None None None 2024-02-13 16:54:19 UTC
Red Hat Product Errata RHSA-2024:0804 0 None None None 2024-02-13 17:08:25 UTC
Red Hat Product Errata RHSA-2024:1027 0 None None None 2024-02-28 18:14:17 UTC
Red Hat Product Errata RHSA-2024:2707 0 None None None 2024-05-06 14:10:29 UTC

Description Sandipan Roy 2023-06-15 06:22:33 UTC 
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.



https://github.com/google/guava/issues/2575
Comment 12 Patrick Del Bello 2023-08-15 18:31:03 UTC 
Created guava tracking bugs for this issue:

Affects: fedora-37 [bug 2232209]
Affects: fedora-38 [bug 2232210]
Comment 16 errata-xmlrpc 2023-09-14 09:52:12 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.5.0

Via RHSA-2023:5165 https://access.redhat.com/errata/RHSA-2023:5165
Comment 18 Catherine_H 2023-09-27 08:45:02 UTC 
Hi Team,

Customer reported this CVE affected image ubi8/openjdk-17:1.16-2. Do we have a plan to fix the CVE in this image?
Any update will be appreciated.

Image: https://catalog.redhat.com/software/containers/ubi8/openjdk-17/618bdbf34ae3739687568813?tag=1.16-2&push_date=1690216094000

Best Regards,
Catherine
Comment 20 errata-xmlrpc 2023-10-05 22:37:33 UTC 
This issue has been addressed in the following products:

  AMQ Broker 7.11.2

Via RHSA-2023:5491 https://access.redhat.com/errata/RHSA-2023:5491
Comment 21 errata-xmlrpc 2023-12-04 17:56:43 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2023:7639 https://access.redhat.com/errata/RHSA-2023:7639
Comment 22 errata-xmlrpc 2023-12-04 17:57:17 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2023:7637 https://access.redhat.com/errata/RHSA-2023:7637
Comment 23 errata-xmlrpc 2023-12-04 17:59:09 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2023:7638 https://access.redhat.com/errata/RHSA-2023:7638
Comment 24 errata-xmlrpc 2023-12-04 18:02:19 UTC 
This issue has been addressed in the following products:

  EAP 7.4.14

Via RHSA-2023:7641 https://access.redhat.com/errata/RHSA-2023:7641
Comment 25 errata-xmlrpc 2023-12-06 23:30:43 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.6.0

Via RHSA-2023:7678 https://access.redhat.com/errata/RHSA-2023:7678
Comment 26 errata-xmlrpc 2023-12-07 14:26:40 UTC 
This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.13.9

Via RHSA-2023:7700 https://access.redhat.com/errata/RHSA-2023:7700
Comment 28 errata-xmlrpc 2024-02-12 10:25:25 UTC 
This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.14

Via RHSA-2024:0777 https://access.redhat.com/errata/RHSA-2024:0777
Comment 29 errata-xmlrpc 2024-02-12 10:36:58 UTC 
This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.12

Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778
Comment 30 errata-xmlrpc 2024-02-13 16:52:25 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 8

Via RHSA-2024:0799 https://access.redhat.com/errata/RHSA-2024:0799
Comment 31 errata-xmlrpc 2024-02-13 16:52:54 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 9

Via RHSA-2024:0800 https://access.redhat.com/errata/RHSA-2024:0800
Comment 32 errata-xmlrpc 2024-02-13 16:53:41 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 7

Via RHSA-2024:0798 https://access.redhat.com/errata/RHSA-2024:0798
Comment 33 errata-xmlrpc 2024-02-13 16:54:11 UTC 
This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2024:0801 https://access.redhat.com/errata/RHSA-2024:0801
Comment 34 errata-xmlrpc 2024-02-13 17:08:16 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2024:0804 https://access.redhat.com/errata/RHSA-2024:0804
Comment 35 errata-xmlrpc 2024-02-28 18:14:08 UTC 
This issue has been addressed in the following products:

  MTA-6.2-RHEL-9
  MTA-6.2-RHEL-8

Via RHSA-2024:1027 https://access.redhat.com/errata/RHSA-2024:1027
Comment 36 Paramvir jindal 2024-04-03 03:50:40 UTC 
Marking EAP-8 as not affected because EAP 8 GA was released with the fixed version.
Comment 40 errata-xmlrpc 2024-05-06 14:10:18 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.4.0 for Spring Boot

Via RHSA-2024:2707 https://access.redhat.com/errata/RHSA-2024:2707
Note You need to log in before you can comment on or make changes to this bug.