GHSA-2c6g-pfx3-w7h8 Insecure Temporary File in RESTEasy

• Maven org.jboss.resteasy:resteasy-core: >= 6.0.0.Beta1, < 6.2.3.Final → fixed in 6.2.3.Final • Maven org.jboss.resteasy:resteasy-core: >= 5.0.0.Alpha1, < 5.0.6.Final → fixed in 5.0.6.Final • Maven org.jboss.resteasy:resteasy-core: >= 4.0.0.Beta1, < 4.7.8.Final → fixed in 4.7.8.Final • Maven org.jboss.resteasy:resteasy-multipart-provider: >= 6.0.0.Beta1, < 6.2.3.Final → fixed in 6.2.3.Final • Maven org.jboss.resteasy:resteasy-multipart-provider: >= 5.0.0.Alpha1, < 5.0.6.Final → fixed in 5.0.6.Final • Maven org.jboss.resteasy:resteasy-multipart-provider: >= 4.0.0.Beta1, < 4.7.8.Final → fixed in 4.7.8.Final • Maven org.jboss.resteasy:resteasy-multipart-provider: < 3.15.5.Final → fixed in 3.15.5.Final • Maven org.jboss.resteasy:resteasy-core: < 3.15.5.Final → fixed in 3.15.5.Final

Impact In RESTEasy the insecure `File.createTempFile()` is used in the `DataSourceProvider`, `FileProvider` and `Mime4JWorkaround` classes which creates temp files with insecure permissions that could be read by a local user. Patches Fixed in the following pull requests: • https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1) • https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final) • https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final) • https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final) • https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final) Workarounds There is no workaround for this issue. References • https://nvd.nist.gov/vuln/detail/CVE-2023-0482 • https://bugzilla.redhat.com/show_bug.cgi?id=2166004 • https://github.com/advisories/GHSA-jrmh-v64j-mjm9