PT-2020-5989 · Google+3 · Guava+3
Jonathan Leitschuh
·
Published
2020-08-27
·
Updated
2026-05-18
·
CVE-2020-8908
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Guava versions prior to 30.0
Guava versions prior to 32.0.0
Description
A temp directory creation vulnerability exists in Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API
com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable, leaving the files open. The method in question has been marked @Deprecated in versions 30.0 and later and should not be used.Recommendations
For Guava versions prior to 30.0, update Guava to version 30.0 or later.
For Guava versions prior to 32.0.0, explicitly change the permissions after the creation of the directory or remove uses of the vulnerable method.
For Android developers, choose a temporary directory API provided by Android, such as
context.getCacheDir().
For other Java developers, migrate to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configure the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.Exploit
Fix
Incorrect Permission
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Guava
Suse