CVE-2020-8908

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

Guava is a set of core Java libraries from Google that includes new collection types (such as multimap and multiset), immutable collections, a graph library, and utilities for concurrency, I/O, hashing, caching, primitives, strings, and more! It is widely used on most Java projects within Google, and widely used by many other companies as well.

Security Fix(es):

A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.(CVE-2020-8908)

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 30.1-jre.tuxcare.

TuxCare rebuilt com.google.guava:guava to address 3 CVEs. Fixed in 20.0.tuxcare.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 31.1-jre.tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 25.1-android-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 27.1-android-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 27.1-jre-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 1 CVE. Fixed in 25.1-jre-tuxcare.2.

TuxCare rebuilt com.google.guava:guava to address 3 CVEs. Fixed in 19.0-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 16.0.1-tuxcare.2.

TuxCare rebuilt com.google.guava:guava to address 1 CVE. Fixed in 10.0.1-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 1 CVE. Fixed in 27.0.1-android-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 1 CVE. Fixed in 12.0.1-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 1 CVE. Fixed in 31.1-android-tuxcare.2.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 31.0.1-jre-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 2 CVEs. Fixed in 30.1.1-jre-tuxcare.1.

TuxCare rebuilt com.google.guava:guava to address 1 CVE. Fixed in 31.0.1-android-tuxcare.2.

A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open (CVE-2020-8908).

A bug that could allow an attacker with access to the machine to potentially access data in a temporary directory created by the Guava. (CVE-2020-8908) Predictable temporary files and directories used in FileBackedOutputStream. (CVE-2023-2976)

These are all security issues fixed in the guava-30.1.1-1.2 package on the GA media of openSUSE Tumbleweed.

This update for guava fixes the following issues:

Upgrade to guava 32.0.1:

• CVE-2020-8908: Fixed predictable temporary files and directories used in FileBackedOutputStream (bsc#1179926).
• CVE-2023-2976: Fixed a temp directory creation vulnerability (bsc#1212401).

This update for guava fixes the following issues:

• Upgrade to guava from v30.1.1 to v32.0.1
• CVE-2023-2976: Fixed Predictable temporary files and directories used in FileBackedOutputStream. (bsc#1212401)
• CVE-2020-8908: Fixed a bug that could allow an attacker with access to the machine to potentially access data in a temporary directory created by the Guava. (bsc#1179926)