Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[MSHARED-1296] [SECURITY] Fix Temporary File Information Disclosure Vulnerability #62

Merged
merged 1 commit into from
Aug 15, 2023
Merged

[MSHARED-1296] [SECURITY] Fix Temporary File Information Disclosure Vulnerability #62

merged 1 commit into from
Aug 15, 2023

Commits on Nov 18, 2022

  1. vuln-fix: Temporary File Information Disclosure 

    This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: JLLeitschuh/security-research#18


Co-authored-by: Moderne <team@moderne.io>
    @JLLeitschuh @TeamModerne
    JLLeitschuh and TeamModerne committed Nov 18, 2022
    Configuration menu
    Copy the full SHA
    876fd2c View commit details
    Browse the repository at this point in the history