CVE-2020-8908
Publication date 10 December 2020
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Status
Package | Ubuntu Release | Status |
---|---|---|
guava-libraries | 24.10 oracular |
Not affected
|
24.04 LTS noble |
Needs evaluation
|
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty |
Needs evaluation
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 3.3 · Low |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | Low |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
References
Other references
- https://github.com/google/guava/issues/4011
- https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40
- https://github.com/google/guava/issues/4011#issuecomment-1573923586
- https://github.com/google/guava/releases/tag/v32.0.0
- https://github.com/google/guava/issues/2575
- https://www.cve.org/CVERecord?id=CVE-2020-8908