https://bugzilla.redhat.com/show_bug.cgi?id=1953024
Bug ID: 1953024
Summary: CVE-2021-28168 jersey: Local information disclosure
via system temporary directory
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, aos-bugs(a)redhat.com,
bibryam(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, dbecker(a)redhat.com,
dchen(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, eric.wittmann(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
gang.wei(a)intel.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, hbraun(a)redhat.com,
ibek(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jross(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
nstielau(a)redhat.com, pantinor(a)redhat.com,
pjindal(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sd-operator-metering(a)redhat.com,
slinaber(a)redhat.com, sponnaga(a)redhat.com,
swoodman(a)redhat.com, tflannag(a)redhat.com,
tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local
information disclosure vulnerability. This is due to the use of the
File.createTempFile which creates a file inside of the system temporary
directory with the permissions: -rw-r--r--. Thus the contents of this file are
viewable by all other users locally on the system. As such, if the contents
written is security sensitive, it can be disclosed to other local users.
References:
https://github.com/eclipse-ee4j/jersey/security/advisories/GHSA-c43q-5hpj...
https://github.com/eclipse-ee4j/jersey/pull/4712
--
You are receiving this mail because:
You are on the CC list for the bug.