CVEvulnerability

CVE-2022-24823

5.5 MEDIUM Published 2022-05-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
1.9 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-378, CWE-379, CWE-668

Description

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

Affected configurations

• netty netty (< 4.1.77) • oracle financial services crime and compliance management studio 8.0.8.2.0 • oracle financial services crime and compliance management studio 8.0.8.3.0 • netapp active iq unified manager • netapp oncommand workflow automation • netapp snapcenter

Related

Weakness · CWE (3)

  • CWE-378 Creation of Temporary File With Insecure Permissions weakness
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

Referenced by CWE · observed example (1)

  • CWE-378 Creation of Temporary File With Insecure Permissions weakness

References