CVE-2020-8908
Description
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
How to fix
- google guava32.0.0 or later
- quarkus quarkus1.11.4 or later
- oracle nosql_database20.3 or later
- com.google.guava:guava32.0.0-android or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google guava | v < 32.0.0 | 32.0.0 |
| quarkus quarkus | v < 1.11.4 | 1.11.4 |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle communications_cloud_native_core_network_slice_selection_function | 1.2.1 | — |
| oracle communications_pricing_design_center | 12.0.0.4.0, 12.0.0.5.0 | — |
| oracle data_integrator | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle nosql_database | v < 20.3 | 20.3 |
| oracle peoplesoft_enterprise_peopletools | 8.57, 8.58, 8.59 | — |
| oracle retail_customer_management_and_segmentation_foundation | 16.0 ≤ v ≤ 19.0 | — |
| oracle weblogic_server | 14.1.1.0.0 | — |
| oracle communications_cloud_native_core_network_repository_function | 1.14.0 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 18.8, 19.12, 20.12, 21.12 | — |
| netapp active_iq_unified_manager | No range specified | — |
| com.google.guava:guavaMaven | v < 32.0.0-android | 32.0.0-android |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.