CVE-2021-28168: Infoleak
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-28168?
CVE-2021-28168 is a local information disclosure vulnerability found in Eclipse Jersey versions 2.28 to 2.33 and versions 3.0.0 to 3.0.1.
What is the severity of CVE-2021-28168?
The severity of CVE-2021-28168 is medium, with a severity value of 6.2.
How does CVE-2021-28168 work?
CVE-2021-28168 allows an attacker to read the contents of a file created in the system temporary directory, potentially exposing sensitive information.
Which software versions are affected by CVE-2021-28168?
Eclipse Jersey versions 2.28 to 2.33 and versions 3.0.0 to 3.0.1 are affected by CVE-2021-28168.
How can I fix CVE-2021-28168?
To fix CVE-2021-28168, it is recommended to upgrade to Eclipse Jersey version 2.34 or 3.0.2, depending on the affected version.