{"id":"CVE-2022-21126","aliases":["EUVD-2022-7293","GHSA-96vh-4rfp-c42c","UBUNTU-CVE-2022-21126"],"status":"published","title":"Creation of Temporary File in Directory with Insecure Permissions","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00753,"percentile":0.55564,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668"],"published":"2022-11-29T16:50:19Z","modified":"2026-10-28T10:25:34Z","fixes":[{"ecosystem":"Maven","package":"com.github.samtools:htsjdk","fixed_in":["3.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.github.samtools:htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.github.samtools:htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"versions":["1.128","1.129","1.130","1.131","1.132","1.133","1.134","1.135","1.136","1.137","1.138","1.139","1.140","1.141","1.142","1.143","2.0.0","2.0.1","2.1.0","2.1.1","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.13.1","2.13.2","2.14.0","2.14.1","2.14.2","2.14.3","2.15.0","2.15.1","2.16.0","2.16.1","2.17.0","2.18.0","2.18.1","2.18.2","2.19.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.20.0","2.20.1","2.20.2","2.20.3","2.21.0","2.21.1","2.21.2","2.21.3","2.22.0","2.23.0","2.24.0","2.24.1","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.8.0","2.8.1","2.9.0","2.9.1","3.0.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+dfsg.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.1+dfsg-1","2.8.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.0+dfsg-2","2.24.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5+dfsg-1","3.0.5+dfsg-2","4.0.2+dfsg-2","4.1.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.3+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.0+dfsg-1","5.0.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"htsjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.3+dfsg-2","4.3.0+dfsg-1"]}],"products":[{"vendor":"samtools","product":"htsjdk"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JAVA-COMGITHUBSAMTOOLS-3149901","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/samtools/htsjdk/pull/1617","tags":["x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21126","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-96vh-4rfp-c42c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21126.json","tags":["advisory"]},{"url":"https://github.com/samtools/htsjdk","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-21126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21126","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-21126","title":"Creation of Temporary File in Directory with Insecure Permissions","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","status":"published","published":"2022-11-29T16:50:19.233Z","modified":"2025-04-24T18:34:51.291Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-7293","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","status":"published","published":"2022-11-29T16:50:19Z","modified":"2025-04-24T18:34:51Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:04.118749Z"}],"ghsa":[{"id":"GHSA-96vh-4rfp-c42c","title":"HTSJDK is vulnerable to exposure of resource(s) to the wrong sphere","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","status":"published","published":"2022-11-29T18:30:18Z","modified":"2023-01-28T05:02:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:36:23.433782Z"}],"nvd":[{"id":"CVE-2022-21126","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","status":"published","published":"2022-11-29T17:15:11.043Z","modified":"2026-06-17T04:25:34.34Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"CVE-2022-21126","title":"Creation of Temporary File in Directory with Insecure Permissions","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","status":"published","published":"2022-11-29T16:50:19.233Z","modified":"2026-10-28T10:25:34.45726953Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"GHSA-96vh-4rfp-c42c","title":"HTSJDK is vulnerable to exposure of resource(s) to the wrong sphere","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","status":"published","published":"2022-11-29T18:30:18Z","modified":"2023-11-08T04:08:04.039802Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"UBUNTU-CVE-2022-21126","description":"The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.","status":"published","published":"2022-11-29T17:15:00Z","modified":"2026-10-17T12:56:16.551633851Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"}]}}