Guava Libraries Temp Directory Vulnerability - CVE-2020-8908
Summary
CVE-2020-8908: A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.F... Affects guava-libraries across 2 version ranges.
< 60a549cadba9f9e10583b4348b5102e8b4087aa7
< fec0dbc4634006a6162cfd4d0d09c962073ddf40
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Guava is a set of core libraries for Java, developed by Google, that provides utilities for collections, caching, primitives support, concurrency libraries, common annotations, string processing, I/O, and more. It is widely used in Java applications for its robust features and ease of use. However, a vulnerability exists in all versions of Guava related to the creation of temporary directories, which can expose sensitive data to unauthorized access.
Vulnerability Detail
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable, making it susceptible to unauthorized access. This vulnerability has been marked as @Deprecated in versions 30.0 and later, indicating that it should not be used. The potential ramifications include data leakage and unauthorized access to sensitive information stored in temporary directories.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate migration is not feasible, a temporary workaround is to manually set the permissions of the created temporary directory after its creation. This can be done using the following code snippet:
import java.io.File;
import java.io.IOException;
public class TempDirWorkaround { public static void main(String[] args) throws IOException { File tempDir =
File.createTempFile("tempDir", null);
tempDir.delete(); // delete the file to create a directory
tempDir.mkdir();
tempDir.setReadable(false);
tempDir.setWritable(true);
tempDir.setExecutable(true);
}
}
Conclusion
The Guava Libraries vulnerability CVE-2020-8908 poses a significant risk due to the insecure creation of temporary directories. Developers are urged to migrate to safer alternatives to protect sensitive data and mitigate potential security risks.
See every vulnerability recorded for guava-libraries →
FAQ
CVE-2020-8908 is a vulnerability in the Guava libraries that allows unauthorized access to temporary directories created by the API, potentially exposing sensitive data.
All versions of Guava are affected by this vulnerability, but it has been marked as @Deprecated in versions 30.0 and later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The recommended fix is to migrate to safer alternatives for creating temporary directories, such as using java.nio.file.Files.createTempDirectory() or Android's context.getCacheDir().
The potential consequences include data leakage and unauthorized access to sensitive information stored in temporary directories, which can lead to security breaches.
Related vulnerabilities
Recent vulnerabilities recorded for guava-libraries.
