medium5.5
CVE-2022-24913
Java Merge-sort Insecure Temporary File vulnerability
Impact
Versions of the package `com.fasterxml.util:java-merge-sort` before 1.1.0 are vulnerable to Insecure Temporary File in the `StdTempFileProvider()` function in `StdTempFileProvider.java`, which uses the permissive `File.createTempFile()` function, exposing temporary file contents.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.fasterxml.util:java-merge-sort | < 1.1.0 | 1.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Java-Merge-Sort Project | Java-Merge-Sort | before 1.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902
- https://github.com/cowtowncoder/java-merge-sort/pull/21
- https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926
- https://github.com/advisories/GHSA-qxxc-7mq4-mf79
- https://nvd.nist.gov/vuln/detail/CVE-2022-24913