Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
Weakness
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Java-merge-sort | Java-merge-sort_project | * | 1.1.0 (excluding) |
Related Attack Patterns
References
- https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902
- https://github.com/cowtowncoder/java-merge-sort/pull/21
- https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926
- https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902
- https://github.com/cowtowncoder/java-merge-sort/pull/21
- https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926