| Name | CVE-2020-8908 |
| Description | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1038979 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| guava-libraries (PTS) | bullseye | 29.0-6 | vulnerable |
| bookworm | 31.1-1 | vulnerable | |
| sid, trixie | 32.0.1-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| guava-libraries | source | (unstable) | 32.0.1-1 | 1038979 |
[bookworm] - guava-libraries <ignored> (Minor issue, mitigated by kernel tmp hardening)
[bullseye] - guava-libraries <no-dsa> (Minor issue)
[buster] - guava-libraries <no-dsa> (Minor issue)
https://github.com/google/guava/issues/4011
https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40
Issue incompletely fixed:
https://github.com/google/guava/issues/4011#issuecomment-1573923586
https://github.com/google/guava/releases/tag/v32.0.0
https://github.com/google/guava/issues/2575