CVE-2020-8908

Aliases:GHSA-5mg8-w23w-74h3SNYK-JAVA-COMGOOGLEGUAVA-1015415DEBIAN-CVE-2020-8908CGA-3c27-qh8r-rcxgCGA-487c-whhh-cr5jCGA-582m-7q55-rmm7CGA-63m8-9xv6-j6mqCGA-6hjv-jhmv-c7vhCGA-6r44-99j2-r784CGA-7r7v-g75h-4ghvCGA-fx9g-xv96-x499CGA-gj8f-rj45-7532CGA-gwhc-979v-fq9xCGA-h5pq-cpcw-2hrjCGA-h8c3-mf37-3qcjCGA-hw3p-rf77-chf2CGA-m85q-xh5j-3mw7CGA-mcm3-69r6-6424CGA-mwgr-jf64-fpcwCGA-pqqc-wc28-4h9qCGA-2cq3-g243-332hCGA-2m53-hmgj-34pxCGA-2x74-26m6-9292CGA-322x-wcfq-3m99CGA-34j8-fx9h-v3gvCGA-35mj-wmx6-pwgvCGA-39g9-8wq6-pgffCGA-39w7-h2jp-rqhgCGA-3cx2-g66w-fxqxCGA-3pmf-f4cv-59prCGA-3r3m-vwhp-xrjhCGA-4vvv-2965-7c48CGA-52v5-p57g-cxjhCGA-56wc-fmx7-jg7mCGA-5p7c-fcpf-jpw6CGA-5p9q-x3q8-mrj5CGA-5x5j-7rmq-8wcmCGA-5xgg-fq2f-ffp7CGA-6474-gv7p-3xq2CGA-64fj-h9p7-2vcqCGA-65q3-r65w-4jcjCGA-665r-7357-w455CGA-6mg5-vjj2-6763CGA-6prw-w526-hm6hCGA-72mh-c54q-97wrCGA-74gj-hcq4-27g9CGA-796v-h9x5-q234CGA-79rq-gj29-225jCGA-7qpg-j6cj-4f5jCGA-7v77-wjj7-242qCGA-7wvh-9cgr-393hCGA-84mp-2wp8-h4q4CGA-85rv-8wrf-g5wgCGA-8grj-vvjp-v3v4CGA-8m52-72jm-c927CGA-8ww2-2pm6-289cCGA-92w6-j4wg-x33gCGA-94q3-49q3-9h8vCGA-9577-x2vp-h9f8CGA-95vp-hg5x-4q8cCGA-988q-94f5-wpw7CGA-9gw9-p8w8-xxxrCGA-9vp4-c3m3-w7ghCGA-9wcp-9m2h-pq5hCGA-c6hm-75w2-8m85CGA-c84g-wjqf-7gh4CGA-cgm3-h3j5-6xcrCGA-ch9c-x4v4-98v6CGA-cphq-hvwv-qmc8CGA-cq3m-r5rh-xj9gCGA-cr63-vv53-wqqxCGA-cvrq-cqc8-h8w9CGA-cwpq-wg55-pm63CGA-f4xg-gjvr-c86xCGA-f62f-p34w-fgx7CGA-f7vj-77vh-79cwCGA-fcvj-jj7j-p333CGA-fqcc-95gf-hrmrCGA-fr3g-wcwc-r29xCGA-fvm5-x8j3-c92pCGA-fvpx-2v87-mx52CGA-fw5j-7h6j-f4mqCGA-g3qw-4gj3-fxgfCGA-gfvh-w7wv-477hCGA-gjm3-gqh9-x9fgCGA-gmx6-8774-hph9CGA-h42j-6jmc-373xCGA-h73r-49pf-v2xjCGA-hfg6-52mc-6g33CGA-hp6g-w9ch-vxf3CGA-hqc9-7v4j-9hg6CGA-hx5g-64p4-c4hrCGA-j4pq-578x-3rqxCGA-j6hh-67m3-pc2vCGA-j6w9-wf8g-jwg5CGA-jjrf-6fr9-3jxmCGA-jx6f-mwgw-x3rrCGA-m3q7-q45q-73f3CGA-m64v-6whm-6g87CGA-m786-w224-rcjwCGA-m7hm-jxj3-9g45CGA-m84r-55fj-rp77CGA-m8x4-w26m-34hqCGA-mc9x-7mvm-7mfhCGA-mf2w-g5w3-m99xCGA-mgmf-99cg-jfjrCGA-mqwp-7c55-h939CGA-p5g2-qrqr-7v4wCGA-prh6-gfj2-q6ghCGA-pvfp-78vq-qp7rCGA-q3g8-j8hc-qmj5CGA-q42v-4fgr-wqh7CGA-q637-r635-j8g7CGA-q76j-mqvg-mxffCGA-qchq-9hhv-q67jCGA-qgv5-jv73-qqqvCGA-qhqf-pqgx-647qCGA-qpjm-wr9q-x8x9CGA-qv66-rv3x-8878CGA-qvfh-v9f6-j954CGA-r23v-5pqp-5fgmCGA-r2hg-3r9j-cx9wCGA-r3c6-pcqf-8c4vCGA-r567-w2pw-fvffCGA-rfmw-3gfq-v3h6CGA-rhxx-4695-wv5fCGA-rjrx-jggv-jfx3CGA-rjwp-c8m2-h96vCGA-rmfj-fcx3-pvx9CGA-rvq5-3xh5-r4w8CGA-v2rf-wfw8-4h36CGA-v37m-m83f-xf74CGA-v387-qghr-xc37CGA-v3m5-r8p5-42qpCGA-v5r2-mg32-x8mpCGA-v67g-2c36-q753CGA-v883-gr6m-r7wrCGA-vcpj-7p4c-9vpcCGA-vq9g-p8qq-jq8jCGA-w36p-hffr-qp5mCGA-w57j-7wph-7xphCGA-w6rm-4j4v-43c5CGA-w7p5-cpvf-ppqmCGA-wf8x-hjh8-rcj9CGA-whjh-v2ff-9rm6CGA-wqhf-rp87-27p8CGA-wr35-4rq3-29j2CGA-wwmq-f5p9-232hCGA-wx64-jjwq-whv2CGA-wxc9-j749-hw8fCGA-x3h8-36j2-pvccCGA-x5gq-5v4f-g284CGA-x5vr-3x6f-4r5gCGA-x8h5-v327-75fwCGA-xc3r-c7g5-pv7hCGA-xfx9-cw3q-cmh6CGA-xrv8-rhv9-cxq8CGA-xrv9-2wh4-5f7hCGA-xvj8-wh32-wpqwCGA-xvw7-35c4-wcxpCGA-xxc9-hhg9-3gvjCGA-2gx2-x4w9-crv9CGA-4rqm-63jp-vc57CGA-52mq-7m87-8vq8CGA-5v34-966h-hh4wCGA-5w96-5cj4-wh5cCGA-7jf7-jv44-r3c6CGA-9mgv-vf5r-j8pjCGA-9w9r-jm57-8742CGA-f396-cqhh-3536CGA-f3gj-fx52-p454CGA-fq8f-j6cv-cc8jCGA-gmfc-28rf-mhqvCGA-h7xf-h9g4-58vqCGA-j47w-xj8c-f7j2CGA-jf5f-p3qv-5v57CGA-jw65-45fx-h53xCGA-m7c7-pmhm-m662CGA-mgxw-f7qw-x3c6CGA-mx5q-22fj-r242CGA-p82f-frw3-9mm4CGA-rg5w-g245-3hgwCGA-v2xw-w7g6-jcphCGA-v3g6-prv5-6x5rCGA-v496-6x9j-mr2xCGA-v6cg-v5cf-m33pCGA-vv9w-5rqw-h2cxCGA-wg8v-693r-5f22CGA-x2cf-5fjg-rpjgCGA-x5qw-69xq-5r4rCGA-25pv-x4c9-j8p6CGA-3rq2-r37m-8378CGA-3wg6-h549-hrpcCGA-475m-rvxm-h2x4CGA-4rcw-2629-p292CGA-54hm-6pqm-84c4CGA-559r-r876-5m65CGA-5p6m-52c5-4w78CGA-5pp4-p669-w4m7CGA-5x2c-m662-qq2pCGA-66pc-935g-7pg8CGA-6ppm-xq9q-6xh4CGA-742f-36pv-hv28CGA-755q-pjg8-h7qpCGA-785r-q592-m8gvCGA-7jvq-pjp4-5hmhCGA-7pfv-cxr3-q4j7CGA-8pf8-6gjp-x2j7CGA-8wg2-pwgv-x2wgCGA-8xjr-7r74-fpqfCGA-9793-452x-9gxwCGA-992g-4frg-c3vgCGA-99xc-mhmg-f46wCGA-9c7p-wqwg-6h4jCGA-cf6c-7g83-j4rwCGA-cmp3-vmc7-v2g9CGA-f342-9p6v-vp76CGA-f3j2-fcp9-g8gwCGA-f6hm-968x-mv8cCGA-frxr-98r8-mcj5CGA-h526-g4v9-jmrwCGA-h6p2-m4g5-78gqCGA-hp2g-j636-9j47CGA-hpq8-f8jh-p3chCGA-hv3j-q6h4-555rCGA-hv3r-2mqg-7x8fCGA-j3r6-3c5p-w3v8CGA-j894-cqvj-fm96CGA-jm3g-cq4r-h8w9CGA-m2cc-fv85-wrh3CGA-mg7g-659r-pj75CGA-q3mm-8pg9-98r7CGA-q98p-pwx7-7hx3CGA-rvj2-qqg8-r8cqCGA-v428-m2mq-q9fxCGA-v5gf-548h-6pp7CGA-v7qq-4jj4-hvfpCGA-vwmq-424j-5hrfCGA-wvhm-jg96-hg99CGA-x686-vvf3-rm57CGA-xccv-5p6h-qp2hCGA-xj37-38r5-3v3xCGA-22wg-7rj3-626hCGA-2v76-f4cj-g6gpCGA-3rmg-v5hp-pwqhCGA-4772-7877-j4vvCGA-4cvv-xx9v-664rCGA-4wg9-j8xw-gv23CGA-5235-5c56-ppphCGA-53cv-rgg6-qv9vCGA-5jx4-c69w-7f5rCGA-63mm-7rgx-v8g9CGA-6h5m-42wg-2v9rCGA-6vch-jprg-vm99CGA-76h6-2mfh-wgwwCGA-7c56-jr63-cm82CGA-7h3v-pgh4-h6qrCGA-7pqx-rx5x-v4ghCGA-832f-5w8g-gcq7CGA-85m6-2f4p-p92pCGA-8c42-fc64-qjxpCGA-99hj-pjp2-wxw7CGA-cm99-4mvv-24fmCGA-cpgf-g4hr-hw7fCGA-f3v5-r7vm-6g4gCGA-fgxh-42wq-rvcqCGA-g3p2-cmc8-hp66CGA-gvww-pg53-rw8cCGA-h339-r59m-r98rCGA-h9v7-c684-cj78CGA-m3cf-c632-pfwrCGA-qrfh-777f-h63pCGA-r9c5-v7pg-8w7vCGA-r9wp-v8gv-7xw4CGA-rg9j-jqp3-jxj9CGA-v5rx-99qp-c7cvCGA-vppm-gjxr-8p42CGA-xfp7-487c-7fmrCGA-xr4c-x3m2-925h
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 10 Dec 2020, 22:10
Last modified:04 Aug 2024, 10:12

Vulnerability Summary

Overall Risk (default)
low
23/100
CVSS Score
3.3 LOW
v3.1 (cve.org)
EPSS Score
0.98% LOW
1% probability +0.90%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

10 Dec 2020, 22:10
Published
Vulnerability first disclosed
04 Aug 2024, 10:12
Last Modified
Vulnerability information updated

Description

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

CVSS Metrics

  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.98%• Percentile: 61%

Techniques & Countermeasures

  • CWE-378•Creation of Temporary File With Insecure Permissions

    Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

  • CWE-732•Incorrect Permission Assignment for Critical Resource

    The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Affected Systems

  • chainguard•cassandra-4.0

    < 0

  • chainguard•cassandra-4.1

    < 0

  • chainguard•cassandra-4.1-compat

    < 0

  • chainguard•cassandra-4.1-iamguarded-compat

    < 0

  • chainguard•cassandra-fips-4.0

    < 0

  • chainguard•cassandra-fips-4.0-compat

    < 0

  • chainguard•cassandra-fips-4.1

    all

  • chainguard•cassandra-reaper

    < 4.0.1-r1

  • chainguard•celeborn-0.5

    < 0.5.4-r26

  • chainguard•celeborn-0.6

    < 0.6.3-r7

  • chainguard•druid

    < 37.0.0-r14 | < 34.0.0-r6 | all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

  • chainguard•eco-java-gradle-5.4

    all

  • chainguard•eco-java-gradle-5.4.1

    all

  • chainguard•eco-java-gradle-5.5

    all

  • chainguard•eco-java-gradle-5.5.1

    all

  • chainguard•eco-java-gradle-5.6

    all

  • chainguard•eco-java-gradle-5.6.1

    all

  • chainguard•eco-java-gradle-5.6.2

    all

  • chainguard•eco-java-gradle-5.6.3

    all

  • chainguard•eco-java-gradle-5.6.4

    all

  • chainguard•eco-java-gradle-6.0

    all

  • chainguard•eco-java-gradle-6.0.1

    all

  • chainguard•eco-java-gradle-6.1

    all

  • chainguard•eco-java-gradle-6.1.1

    all

  • chainguard•eco-java-gradle-6.2

    all

  • chainguard•eco-java-gradle-6.2.1

    all

  • chainguard•eco-java-gradle-6.2.2

    all

  • chainguard•eco-java-gradle-6.3

    all

  • chainguard•eco-java-gradle-6.4

    all

  • chainguard•eco-java-gradle-6.4.1

    all

  • chainguard•eco-java-gradle-6.5

    all

  • chainguard•eco-java-gradle-6.5.1

    all

  • chainguard•eco-java-gradle-6.6

    all

  • chainguard•eco-java-gradle-6.6.1

    all

  • chainguard•eco-java-gradle-6.7

    all

  • chainguard•eco-java-gradle-6.7.1

    all

  • chainguard•eco-java-gradle-6.8

    all

  • chainguard•eco-java-gradle-6.8.1

    all

  • chainguard•eco-java-gradle-6.8.2

    all

  • chainguard•eco-java-gradle-6.8.3

    all

  • chainguard•eco-java-gradle-6.9

    all

  • chainguard•eco-java-gradle-6.9.1

    all

  • chainguard•eco-java-gradle-6.9.2

    all

Showing first 50 affected entries in server-rendered view.

References (84)