File Access Vulnerability in Guava Libraries: CVE-2023-2976
Summary
CVE-2023-2976: Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with ac... Affects guava-libraries versions < 6b1f97ced922d48f071153ad9e631d06383033a4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Guava is a set of core libraries for Java, developed by Google, that provides utilities for collections, caching, primitives support, concurrency libraries, common annotations, string processing, I/O, and more. It is widely used in Java applications for its robust features and ease of use. However, certain versions of Guava, specifically from 1.0 to 31.1, have a vulnerability that allows unauthorized access to files created in the default Java temporary directory on Unix systems and Android Ice Cream Sandwich.
Vulnerability Detail
The vulnerability arises from the use of Java's default temporary directory for file creation in the FileBackedOutputStream class. This design flaw allows other users and applications on the same machine to access sensitive files created by the class, potentially leading to data leakage or unauthorized access. The issue is particularly concerning on Unix systems and Android Ice Cream Sandwich, where multiple users may share the same environment. Although the vulnerability has been addressed in version 32.0.0, it is recommended to use version 32.0.1 due to functionality issues under Windows in the former.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider configuring your application to use a custom temporary directory that restricts access to sensitive files. This can be done by setting the 'java.io.tmpdir' system property to a secure location when starting your Java application. For example:
java -Djava.io.tmpdir=/path/to/secure/tmpdir -jar your-application.jar
Conclusion
CVE-2023-2976 presents a significant risk for applications using vulnerable versions of the Guava libraries, particularly in shared environments. Upgrading to version 32.0.1 is essential to ensure the security of your application and protect sensitive data from unauthorized access.
See every vulnerability recorded for guava-libraries →
FAQ
CVE-2023-2976 is a vulnerability in the Guava libraries that allows unauthorized access to files created in the default Java temporary directory.
Versions 1.0 to 31.1 of the Guava libraries are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
It is recommended to upgrade to version 32.0.1 of the Guava libraries to mitigate this vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for guava-libraries.
