Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
2.1
CVSSv2

CVE-2020-8908

Published: 10/12/2020 Updated: 02/08/2023
CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9
CVSS v3 Base Score: 3.3 | Impact Score: 1.4 | Exploitability Score: 1.8
VMScore: 188
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Google

Vulnerability Summary

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

google guava

quarkus quarkus

oracle peoplesoft enterprise peopletools 8.57

oracle data integrator 12.2.1.3.0

oracle peoplesoft enterprise peopletools 8.58

oracle weblogic server 14.1.1.0.0

oracle data integrator 12.2.1.4.0

oracle nosql database

oracle commerce guided search 11.3.2

oracle peoplesoft enterprise peopletools 8.59

oracle communications cloud native core network slice selection function 1.2.1

oracle retail customer management and segmentation foundation

oracle communications pricing design center 12.0.0.4.0

oracle communications pricing design center 12.0.0.5.0

oracle primavera unifier 18.8

oracle primavera unifier

oracle primavera unifier 19.12

oracle primavera unifier 20.12

oracle communications cloud native core network repository function 1.14.0

oracle primavera unifier 21.12

netapp active iq unified manager -

Vendor Advisories

Debian CVElist Bug Report Logs: guava-libraries: CVE-2020-8908 CVE-2023-2976
Debian Bug report logs - #1038979 guava-libraries: CVE-2020-8908 CVE-2023-2976 Package: src:guava-libraries; Maintainer for src:guava-libraries is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 23 Jun 2023 21:36:01 UTC Owned by: ...
Red Hat: Moderate: Red Hat AMQ Broker 7.8.1 release and security update
Synopsis Moderate: Red Hat AMQ Broker 781 release and security update Type/Severity Security Advisory: Moderate Topic Red Hat AMQ Broker 781 is now available from the Red Hat Customer PortalRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Sc ...
Red Hat: Important: Red Hat Integration Camel-K 1.6.4 release and security update
Synopsis Important: Red Hat Integration Camel-K 164 release and security update Type/Severity Security Advisory: Important Topic A micro version update (from 163 to 164) is now available for Red Hat Integration Camel K that includes bug fixes and enhancements The purpose of this text-only errata is to inform you about the security issu ...
Red Hat: Moderate: Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update
Synopsis Moderate: Red Hat Integration Camel Extensions for Quarkus 221 security update Type/Severity Security Advisory: Moderate Topic A security update to Red Hat Integration Camel Extensions for Quarkus 22 is now available The purpose of this text-only errata is to inform you about the security issues fixedRed Hat Product Security has ...
Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Ops Center Common Services
Multiple vulnerabilities have been found in Hitachi Ops Center Common Services CVE-2020-8908, CVE-2020-14326, CVE-2020-25633, CVE-2020-36518, CVE-2021-20289, CVE-2021-21290, CVE-2021-46877, CVE-2022-3782, CVE-2022-4147, CVE-2022-40151, CVE-2022-40152, CVE-2022-41915, CVE-2022-41946, CVE-2022-41966, CVE-2023-0091, CVE-2023-1370, CVE-2023-28708 ...
Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Ops Center Analyzer viewpoint
Multiple vulnerabilities have been found in Hitachi Ops Center Analyzer viewpoint CVE-2020-8908, CVE-2020-13956, CVE-2020-25649, CVE-2020-25694, CVE-2020-25695, CVE-2020-25696 Affected products and versions are listed below Please upgrade your version to the appropriate version ...
Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer
Multiple vulnerabilities have been found in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer Affected products and versions are listed below Please upgrade your version to the appropriate version To find fixed products, need to find same number following product name in [Affected products] and [Fixed products] ...

Github Repositories

https://github.com/slashben/ks2ovex

Tool for converting Kubescape vulnerability object to OpenVEX

Tool for converting Kubescape vulnerability objects to OpenVEX This is a command line tool for converting Kubescape vulnerability objects to OpenVEX format Usage After cloning this repo, run: go mod tidy go run cmd/maingo data/gcrio-google-samples-microservices-demo-adservice-v080-c5b75fjson data/default-replicaset-adservice-7d857689bd-b630-5e48json

https://github.com/Liftric/dependency-track-companion-plugin

[gradle-plugin] Common tasks for Dependency Track interaction, like SBOM upload or VEX Generation

Gradle Dependency Track Companion w Plugin This Gradle plugin is designed to ease the process of working with Dependency Track, a Continuous SBOM Analysis Platform With this plugin, you can automate the upload process of SBOM files, generate Vex files for component or vulnerability suppression, and more This plugin internally applies the CycloneDX Gradle plugin, so you don�

https://github.com/rshoemake/parallel-consumer-dotnet

This is a .Net translation of the Java based Confluent parallel consumer component.

Kafka Net Parallel Consumer Parallel Apache Kafka client wrapper with client side queueing, a simpler consumer/producer API with key concurrency and extendable non-blocking IO processing Confluent’s product page for the project is here 💡 If you like this project, please ⭐ Star it in GitHub to show your appreciation, help us gauge popularity of the proj

https://github.com/confluentinc/parallel-consumer

Parallel Apache Kafka client wrapper with per message ACK, client side queueing, a simpler consumer/producer API with key concurrency and extendable non-blocking IO processing.

Confluent Parallel Consumer Parallel Apache Kafka client wrapper with client side queueing, a simpler consumer/producer API with key concurrency and extendable non-blocking IO processing Confluent’s product page for the project is here 💡 If you like this project, please ⭐ Star it in GitHub to show your appreciation, help us gauge popularity of the pr

References

CWE-732https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40https://github.com/google/guava/issues/4011https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://security.netapp.com/advisory/ntap-20220210-0003/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://lists.apache.org/thread.html/r007add131977f4f576c232b25e024249a3d16f66aad14a4b52819d21%40%3Ccommon-issues.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a%40%3Ctorque-dev.db.apache.org%3Ehttps://lists.apache.org/thread.html/r79e47ed555bdb1180e528420a7a2bb898541367a29a3bc6bbf0baf2c%40%3Cissues.hive.apache.org%3Ehttps://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604%40%3Ctorque-dev.db.apache.org%3Ehttps://lists.apache.org/thread.html/r5b3d93dfdfb7708e796e8762ab40edbde8ff8add48aba53e5ea26f44%40%3Cissues.geode.apache.org%3Ehttps://lists.apache.org/thread.html/r3dd8881de891598d622227e9840dd7c2ef1d08abbb49e9690c7ae1bc%40%3Cissues.geode.apache.org%3Ehttps://lists.apache.org/thread.html/rfc27e2727a20a574f39273e0432aa97486a332f9b3068f6ac1346594%40%3Cdev.myfaces.apache.org%3Ehttps://lists.apache.org/thread.html/r58a8775205ab1839dba43054b09a9ab3b25b423a4170b2413c4067ac%40%3Ccommon-issues.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/rb2364f4cf4d274eab5a7ecfaf64bf575cedf8b0173551997c749d322%40%3Cgitbox.hive.apache.org%3Ehttps://lists.apache.org/thread.html/rd7e12d56d49d73e2b8549694974b07561b79b05455f7f781954231bf%40%3Cdev.pig.apache.org%3Ehttps://lists.apache.org/thread.html/r7b0e81d8367264d6cad98766a469d64d11248eb654417809bfdacf09%40%3Cyarn-issues.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/r68d86f4b06c808204f62bcb254fcb5b0432528ee8d37a07ef4bc8222%40%3Ccommits.ws.apache.org%3Ehttps://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/rd2704306ec729ccac726e50339b8a8f079515cc29ccb77713b16e7c5%40%3Cissues.hive.apache.org%3Ehttps://lists.apache.org/thread.html/re120f6b3d2f8222121080342c5801fdafca2f5188ceeb3b49c8a1d27%40%3Cyarn-issues.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/r07ed3e4417ad043a27bee7bb33322e9bfc7d7e6d1719b8e3dfd95c14%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/rb8c0f1b7589864396690fe42a91a71dea9412e86eec66dc85bbacaaf%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/r6874dfe26eefc41b7c9a5e4a0487846fc4accf8c78ff948b24a1104a%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r4776f62dfae4a0006658542f43034a7fc199350e35a66d4e18164ee6%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3%40%3Ctorque-dev.db.apache.org%3Ehttps://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4e748%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rf9f0fa84b8ae1a285f0210bafec6de2a9eba083007d04640b82aa625%40%3Cissues.geode.apache.org%3Ehttps://lists.apache.org/thread.html/rf00b688ffa620c990597f829ff85fdbba8bf73ee7bfb34783e1f0d4e%40%3Cyarn-dev.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/r5d61b98ceb7bba939a651de5900dbd67be3817db6bfcc41c6e04e199%40%3Cyarn-issues.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/r49549a8322f62cd3acfa4490d25bfba0be04f3f9ff4d14fe36199d27%40%3Cyarn-dev.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/rcafc3a637d82bdc9a24036b2ddcad1e519dd0e6f848fcc3d606fd78f%40%3Cdev.hive.apache.org%3Ehttps://lists.apache.org/thread.html/r2fe45d96eea8434b91592ca08109118f6308d60f6d0e21d52438cfb4%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r215b3d50f56faeb2f9383505f3e62faa9f549bb23e8a9848b78a968e%40%3Ccommits.ws.apache.org%3Ehttps://lists.apache.org/thread.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95%40%3Cgithub.arrow.apache.org%3Ehttps://lists.apache.org/thread.html/reebbd63c25bc1a946caa419cec2be78079f8449d1af48e52d47c9e85%40%3Cissues.geode.apache.org%3Ehttps://lists.apache.org/thread.html/ra7ab308481ee729f998691e8e3e02e93b1dedfc98f6b1cd3d86923b3%40%3Cyarn-issues.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/r161b87f8037bbaff400194a63cd2016c9a69f5949f06dcc79beeab54%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r294be9d31c0312d2c0837087204b5d4bf49d0552890e6eec716fa6a6%40%3Cyarn-issues.hadoop.apache.org%3Ehttps://lists.apache.org/thread.html/rc607bc52f3507b8b9c28c6a747c3122f51ac24afe80af2a670785b97%40%3Cissues.geode.apache.org%3Ehttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038979https://nvd.nist.govhttps://github.com/slashben/ks2ovexhttps://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-116/index.html
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27977IMAPlocal usersCVE-2024-32038CVE-2023-49963CVE-2023-22869CVE-2024-31497localCVE-2024-2961
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook