https://bugzilla.redhat.com/show_bug.cgi?id=1927028
Bug ID: 1927028
Summary: CVE-2021-21290 netty: Information disclosure via the
local system temporary directory
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
clement.escoffier(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eleandro(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gsmet(a)redhat.com, hamadhan(a)redhat.com,
hhudgeon(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jerboaa(a)gmail.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jross(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, nmoumoul(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
probinso(a)redhat.com, rchan(a)redhat.com,
rgodfrey(a)redhat.com, rguimara(a)redhat.com,
rjerrido(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sbiarozk(a)redhat.com, sdaley(a)redhat.com,
sdouglas(a)redhat.com, smaestri(a)redhat.com,
sochotni(a)redhat.com, sokeeffe(a)redhat.com,
spinder(a)redhat.com, sponnaga(a)redhat.com,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, theute(a)redhat.com,
tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
In Netty before version 4.1.59.Final there is a vulnerability on Unix-like
systems involving an insecure temp file. When netty's multipart decoders are
used local information disclosure can occur via the local system temporary
directory if temporary storing uploads on the disk is enabled. On unix-like
systems, the temporary directory is shared between all user. As such, writing
to this directory using APIs that do not explicitly set the file/directory
permissions can lead to information disclosure. Of note, this does not impact
modern MacOS Operating Systems. The method "File.createTempFile" on unix-like
systems creates a random file, but, by default will create this file with the
permissions "-rw-r--r--". Thus, if sensitive information is written to this
file, other local users can read this information. This is the case in netty's
"AbstractDiskHttpData" is vulnerable. This has been fixed in version
4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when
you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the
directory to something that is only readable by the current user.
References:
https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0...
https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2
--
You are receiving this mail because:
You are on the CC list for the bug.