~ / search / GHSA-5mg8-w23w-74h3

GHSA-5mg8-w23w-74h3

Information Disclosure in Guava

Source: GitHub Advisory Database (reviewed) Low CVE-2020-8908

Packages

EcosystemPackageAffectedFixed in
Maven com.google.guava:guava < 32.0.0-android 32.0.0-android

Details

As written in the advisory (Markdown source, shown as plain text).

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

References

External links from the advisory. They lead to third-party sites.