CVE-2023-2976: Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Other sources
Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.google.guava:guavato a version that resolves this vulnerability.Fixed in 32.0.0-android - Upgrade
Upgrade
redhat/guavato a version that resolves this vulnerability.Fixed in 32.0.0 - Upgrade
Upgrade
google/guavato a version that resolves this vulnerability.Fixed in 32.0.1 - Compensating control
Mitigate the vulnerability affecting FileBackedOutputStream by avoiding use of Java's default temporary directory for file creation (on Unix systems and Android Ice Cream Sandwich, versions 1.0 to 31.1) so other users/apps with access to that default temp directory cannot access the created files.
Event History
Frequently Asked Questions
What is CVE-2023-2976?
CVE-2023-2976 is a vulnerability that allows other users and apps on Unix systems and Android Ice Cream Sandwich to access files created in Java's default temporary directory in FileBackedOutputStream in Google Guava versions 1.0 to 31.1.
What is the severity of CVE-2023-2976?
The severity of CVE-2023-2976 is high with a severity value of 7.1.
How does CVE-2023-2976 affect affected software?
CVE-2023-2976 affects Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich.
How can I fix CVE-2023-2976?
To fix CVE-2023-2976, it is recommended to upgrade to Google Guava version 32.0.0 or higher.
What are the references for CVE-2023-2976?
The references for CVE-2023-2976 are: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-2976), [GitHub Issue 2575](https://github.com/google/guava/issues/2575), [GitHub Issue 6532](https://github.com/google/guava/issues/6532).