A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtimes java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Guava | * | 32.0.0 (excluding) | |
| Red Hat AMQ 7.8.1 | RedHat | guava | * |
| Red Hat EAP-XP via EAP 7.3.x base | RedHat | guava | * |
| Red Hat JBoss Enterprise Application Platform 7 | RedHat | guava | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-activemq-artemis-0:2.9.0-9.redhat_00019.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-bouncycastle-0:1.68.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-guava-failureaccess-0:1.0.1-1.redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-guava-libraries-0:30.1.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-hal-console-0:3.2.13-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-ironjacamar-0:1.4.27-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-ejb-client-0:4.0.39-1.SP1_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-logmanager-0:2.1.18-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-remoting-0:5.0.20-2.SP1_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-server-migration-0:1.7.2-5.Final_redhat_00006.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-narayana-0:5.9.11-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-undertow-0:2.0.34-1.SP1_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-0:7.3.6-1.GA_redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-elytron-0:1.10.11-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-http-client-0:1.0.25-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-naming-client-0:1.0.14-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-activemq-artemis-0:2.9.0-9.redhat_00019.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-bouncycastle-0:1.68.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-guava-failureaccess-0:1.0.1-1.redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-guava-libraries-0:30.1.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-hal-console-0:3.2.13-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-ironjacamar-0:1.4.27-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-ejb-client-0:4.0.39-1.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-logmanager-0:2.1.18-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-remoting-0:5.0.20-2.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.7.2-5.Final_redhat_00006.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-narayana-0:5.9.11-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-undertow-0:2.0.34-1.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-0:7.3.6-1.GA_redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-elytron-0:1.10.11-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-http-client-0:1.0.25-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-naming-client-0:1.0.14-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-activemq-artemis-0:2.9.0-9.redhat_00019.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-bouncycastle-0:1.68.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-guava-failureaccess-0:1.0.1-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-guava-libraries-0:30.1.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-hal-console-0:3.2.13-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-ironjacamar-0:1.4.27-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-ejb-client-0:4.0.39-1.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-logmanager-0:2.1.18-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-remoting-0:5.0.20-2.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-server-migration-0:1.7.2-5.Final_redhat_00006.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-narayana-0:5.9.11-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-undertow-0:2.0.34-1.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-0:7.3.6-1.GA_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-elytron-0:1.10.11-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-http-client-0:1.0.25-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-naming-client-0:1.0.14-1.Final_redhat_00001.1.el8eap | * |
| Red Hat Satellite 6.10 for RHEL 7 | RedHat | candlepin-0:4.0.9-1.el7sat | * |
| Red Hat Single Sign-On 7.4.6 | RedHat | guava | * |
| RHINT Camel-K 1.6.4 | RedHat | guava | * |
| RHINT Camel-Q 2.2.1 | RedHat | guava | * |
| Guava-libraries | Ubuntu | bionic | * |
| Guava-libraries | Ubuntu | kinetic | * |
| Guava-libraries | Ubuntu | lunar | * |
| Guava-libraries | Ubuntu | mantic | * |
| Guava-libraries | Ubuntu | trusty | * |
| Guava-libraries | Ubuntu | trusty/esm | * |
| Guava-libraries | Ubuntu | upstream | * |
| Guava-libraries | Ubuntu | xenial | * |