~ / search / GHSA-2c6g-pfx3-w7h8

GHSA-2c6g-pfx3-w7h8

Insecure Temporary File in RESTEasy

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-0482

Packages

EcosystemPackageAffectedFixed in
Maven org.jboss.resteasy:resteasy-core >= 6.0.0.Beta1, < 6.2.3.Final 6.2.3.Final
Maven org.jboss.resteasy:resteasy-core >= 5.0.0.Alpha1, < 5.0.6.Final 5.0.6.Final
Maven org.jboss.resteasy:resteasy-core >= 4.0.0.Beta1, < 4.7.8.Final 4.7.8.Final
Maven org.jboss.resteasy:resteasy-multipart-provider >= 6.0.0.Beta1, < 6.2.3.Final 6.2.3.Final
Maven org.jboss.resteasy:resteasy-multipart-provider >= 5.0.0.Alpha1, < 5.0.6.Final 5.0.6.Final
Maven org.jboss.resteasy:resteasy-multipart-provider >= 4.0.0.Beta1, < 4.7.8.Final 4.7.8.Final
Maven org.jboss.resteasy:resteasy-multipart-provider < 3.15.5.Final 3.15.5.Final
Maven org.jboss.resteasy:resteasy-core < 3.15.5.Final 3.15.5.Final

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact In RESTEasy the insecure `File.createTempFile()` is used in the `DataSourceProvider`, `FileProvider` and `Mime4JWorkaround` classes which creates temp files with insecure permissions that could be read by a local user. ### Patches Fixed in the following pull requests: * https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1) * https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final) * https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final) * https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final) * https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final) ### Workarounds There is no workaround for this issue. ### References * https://nvd.nist.gov/vuln/detail/CVE-2023-0482 * https://bugzilla.redhat.com/show_bug.cgi?id=2166004 * https://github.com/advisories/GHSA-jrmh-v64j-mjm9

References

External links from the advisory. They lead to third-party sites.