medium5.5

CVE-2023-0482

Insecure Temporary File in RESTEasy

Impact

### Impact In RESTEasy the insecure `File.createTempFile()` is used in the `DataSourceProvider`, `FileProvider` and `Mime4JWorkaround` classes which creates temp files with insecure permissions that could be read by a local user. ### Patches Fixed in the following pull requests: * https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1) * https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final) * https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final) * https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final) * https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final) ### Workarounds There is no workaround for this issue. ### References * https://nvd.nist.gov/vuln/detail/CVE-2023-0482 * https://bugzilla.redhat.com/show_bug.cgi?id=2166004 * https://github.com/advisories/GHSA-jrmh-v64j-mjm9

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.jboss.resteasy:resteasy-core`	>= 6.0.0.Beta1, < 6.2.3.Final	6.2.3.Final
maven	`org.jboss.resteasy:resteasy-multipart-provider`	>= 6.0.0.Beta1, < 6.2.3.Final	6.2.3.Final

Affected products

Vendor	Product	Affected versions
Redhat	Resteasy	Versions 3.15.4, 4.7.7, 5.0.5, 6.2.2
Netapp	Active Iq Unified Manager	All versions
Netapp	Oncommand Workflow Automation	All versions

Weakness classification

CWE-378