GHSA-qxxc-7mq4-mf79

Java Merge-sort Insecure Temporary File vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-24913

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.fasterxml.util:java-merge-sort	< 1.1.0	1.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package `com.fasterxml.util:java-merge-sort` before 1.1.0 are vulnerable to Insecure Temporary File in the `StdTempFileProvider()` function in `StdTempFileProvider.java`, which uses the permissive `File.createTempFile()` function, exposing temporary file contents.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-24913 advisory
https://github.com/cowtowncoder/java-merge-sort/pull/21 web
https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902 web
https://github.com/cowtowncoder/java-merge-sort package
https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926 web