tree 54b3370ac44d03de04684df725acc254c1ccd3d2
parent 15ed4445758a4a86f5541b2e752ec221f166b2d1
author Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> 1668811597 +0000
committer Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> 1668811597 +0000
gpgsig -----BEGIN PGP SIGNATURE-----
 Version: BCPG v1.67
 
 iF4EABYIAAYFAmN4C04ACgkQz5DsYvZUaKF7ngD/QE0Dkw0ioD6MftxED/x1aHdS
 FHErlgQT8hcf6ZvsgtYA/2mbH+Y6TlaN4jHoPIUgvS18WXOydV10RIytYj9fP5gL
 =mJ7F
 -----END PGP SIGNATURE-----

vuln-fix: Temporary File Information Disclosure


This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18


Co-authored-by: Moderne <team@moderne.io>