CVE-2022-24913: Java Merge-sort Insecure Temporary File vulnerability in com.fasterxml.util:java-merge-sort

Background

The package com.fasterxml.util:java-merge-sort is a Java library that provides merge-sort functionality. It is commonly used in applications that require sorting large datasets efficiently. This package uses temporary files during the sorting process to store intermediate results. However, versions before 1.1.0 are vulnerable to an Insecure Temporary File issue in the StdTempFileProvider() function in StdTempFileProvider.java. This function uses the permissive File.createTempFile() function, which exposes the contents of temporary files.

Vulnerability Detail

The Insecure Temporary File vulnerability in com.fasterxml.util:java-merge-sort allows an attacker to access the contents of temporary files created during the sorting process. This can lead to unauthorized disclosure of sensitive information stored in these files. The vulnerability arises from the use of the permissive File.createTempFile() function, which does not enforce proper file permissions. An attacker with local access to the system can exploit this vulnerability to read the temporary file contents and potentially extract sensitive data.

Workaround

As a temporary workaround, users can manually modify the code in StdTempFileProvider.java to use a more secure method for creating temporary files. One possible approach is to use the Files.createTempFile() method from the Java NIO API, which provides better control over file permissions. Here is an example of the modified code:

import java.nio.file.Files;
import java.nio.file.Path;

public class StdTempFileProvider {
  public File createTempFile() throws IOException {
    Path tempFilePath = Files.createTempFile(null, null);
    return tempFilePath.toFile();
  }
}

Conclusion

The Insecure Temporary File vulnerability in com.fasterxml.util:java-merge-sort exposes the contents of temporary files, potentially leading to unauthorized disclosure of sensitive information. To mitigate this vulnerability, it is recommended to upgrade to version 1.1.0 or later. A temporary workaround is also available by modifying the code in StdTempFileProvider.java. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for com.fasterxml.util:java-merge-sort →

FAQ