CVE Vulnerabilities

CVE-2023-0481

Creation of Temporary File With Insecure Permissions

Published: Feb 24, 2023 | Modified: Nov 21, 2024
CVSS 3.x
3.3
LOW
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
5.3 LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Ubuntu

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.

Weakness

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

Affected Software

Name Vendor Start Version End Version
Quarkus Quarkus * 2.16.1 (excluding)
Red Hat build of Quarkus 2.13.8.Final RedHat io.quarkus.resteasy.reactive/resteasy-reactive-common:2.13.8.Final-redhat-00004 *

Potential Mitigations

References