GHSA-2c6g-pfx3-w7h8MediumCVSS 5.5

Insecure Temporary File in RESTEasy

Published
January 15, 2025
Last Modified
January 15, 2025

🔗 CVE IDs covered (1)

CVE-2023-0482 →

📋 Description

Impact

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

Patches

Fixed in the following pull requests:

  • https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1)
  • https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final)
  • https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final)
  • https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final)
  • https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final)

Workarounds

There is no workaround for this issue.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2023-0482
  • https://bugzilla.redhat.com/show_bug.cgi?id=2166004
  • https://github.com/advisories/GHSA-jrmh-v64j-mjm9

🎯 Affected products8

  • maven/org.jboss.resteasy:resteasy-core:>= 6.0.0.Beta1, < 6.2.3.Final
  • maven/org.jboss.resteasy:resteasy-core:>= 5.0.0.Alpha1, < 5.0.6.Final
  • maven/org.jboss.resteasy:resteasy-core:>= 4.0.0.Beta1, < 4.7.8.Final
  • maven/org.jboss.resteasy:resteasy-multipart-provider:>= 6.0.0.Beta1, < 6.2.3.Final
  • maven/org.jboss.resteasy:resteasy-multipart-provider:>= 5.0.0.Alpha1, < 5.0.6.Final
  • maven/org.jboss.resteasy:resteasy-multipart-provider:>= 4.0.0.Beta1, < 4.7.8.Final
  • maven/org.jboss.resteasy:resteasy-multipart-provider:< 3.15.4.Final
  • maven/org.jboss.resteasy:resteasy-core:< 3.15.4.Final

🔗 References (15)