PT-2020-5517 · Junit+4 · Junit4+4

Published 2020-10-12 · Updated 2022-06-11 · CVE-2020-15250

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JUnit4 versions 4.7 through 4.13.1

Description The issue is related to a local information disclosure vulnerability in the test rule TemporaryFolder of JUnit4. On Unix-like systems, the system's temporary directory is shared between all users, making files and directories written into this directory readable by other users on the same system. This vulnerability impacts JUnit tests that write sensitive information, such as API keys or passwords, into the temporary folder and execute in an environment with other untrusted users.

Recommendations For Java 1.7 and higher users: update to version 4.13.1 to fix the vulnerability. For Java 1.6 and lower users: no patch is available, specify the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user as a workaround. As a temporary workaround, consider restricting access to the temporary folder to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

ALT-PU-2022-2035

AZL-41745

BDU:2021-01029

CVE-2020-15250

DLA-2426-1

GHSA-269G-PWP5-87PP

MGASA-2020-0403

OESA-2021-1053

USN-4731-1

Affected Products

Alt Linux

Astra Linux

Junit4

Linuxmint

Ubuntu

References · 96

• 🔥 https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp · Exploit
• https://github.com/junit-team/junit4/commit/610155b8c22138329f0723eec22521627dbc52ae · Patch
• https://ubuntu.com/security/CVE-2020-15250 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/USN-4731-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4731-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15250 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15250 · Vendor Advisory
• https://junit.org/junit4/javadoc/4.13/org/junit/rules/TemporaryFolder.html · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2426 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15250 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-269g-pwp5-87pp · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1053 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2426-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15250 · Vendor Advisory