GitHub Advisoryadvisory · Maven

GHSA-qxxc-7mq4-mf79 Java Merge-sort Insecure Temporary File vulnerability

MEDIUM Published 2023-01-12 Modified 2023-01-20 Official page ↗
Aliases
CVE-2022-24913
Ecosystem
Maven
Packages
com.fasterxml.util:java-merge-sort
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-377, CWE-668
Reviewed
2023-01-12

Affected packages

• Maven com.fasterxml.util:java-merge-sort: < 1.1.0 → fixed in 1.1.0

Description

Versions of the package `com.fasterxml.util:java-merge-sort` before 1.1.0 are vulnerable to Insecure Temporary File in the `StdTempFileProvider()` function in `StdTempFileProvider.java`, which uses the permissive `File.createTempFile()` function, exposing temporary file contents.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2022-24913 Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the… vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References