GHSA-q84x-3476-8ff2

Apache James MIME4J vulnerable to information disclosure to local users

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-45787

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.james:apache-mime4j-storage	< 0.8.9	0.8.9

Details

As written in the advisory (Markdown source, shown as plain text).

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-45787 advisory
https://github.com/apache/james-mime4j/commit/021eb79ba312fe5a7f99fa867ee5350aa5533069 web
https://github.com/apache/james-mime4j package
https://github.com/apache/james-mime4j/blob/master/CHANGELOG.md#089---2022-12-30 web
https://issues.apache.org/jira/browse/MIME4J-322 web
https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj web