GHSA-j75r-vf64-6rrh
RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.quarkus.resteasy.reactive:resteasy-reactive-common | < 3.0.0.Alpha4 | 3.0.0.Alpha4 |
Details
As written in the advisory (Markdown source, shown as plain text).
In RestEasy Reactive implementation of Quarkus the insecure `File.createTempFile()` is used in the `FileBodyHandler` class which creates temp files with insecure permissions that could be read by a local user.
References
External links from the advisory. They lead to third-party sites.