PT-2021-14501 · Unknown+1 · Openapi Generator+1

Wing328 · Published 2021-04-27 · Updated 2021-05-07 · CVE-2021-21429

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenAPI Generator versions prior to 5.1.0

Description The issue arises from using File.createTempFile in JDK, resulting in the creation of insecure temporary files. This can leave application and system data vulnerable to attacks, specifically impacting unix-like systems where the local system temporary directory is shared between all users. The OpenAPI Generator Maven plug-in creates these insecure temporary files during the code generation process to store OpenAPI specification files, potentially disclosing the contents of the specification file to other local users.

Recommendations For versions prior to 5.1.0, update to the v5.1.0 stable version, which patches the issue with Files.createTempFile.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-379

CWE-378

CWE-552

CWE-377

Related Identifiers

CVE-2021-21429

GHSA-867Q-77CC-98MV

Affected Products

Jdk

Openapi Generator

References · 6

• https://github.com/OpenAPITools/openapi-generator/pull/8795 · Patch
• https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-867q-77cc-98mv · Patch
• https://osv.dev/vulnerability/CVE-2021-21429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21429 · Security Note
• https://osv.dev/vulnerability/GHSA-867q-77cc-98mv · Vendor Advisory
• https://github.com/OpenAPITools/openapi-generator/blob/06ad7a51eff04393203cfa715e54e1fb59d984fe/modules/openapi-generator-maven-plugin/src/main/java/org/openapitools/codegen/plugin/CodeGenMojo.java#L782-L799 · Note