Sign In

CVE-2020-8908

ADVISORY - github

Summary

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

EPSS Score⁠: 0.00072 (0.221)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-378⁠

Creation of Temporary File With Insecure Permissions

CWE-732⁠

Incorrect Permission Assignment for Critical Resource

ADVISORY - github

CWE-173⁠

Improper Handling of Alternate Encoding

CWE-200⁠

Exposure of Sensitive Information to an Unauthorized Actor

CWE-378⁠

Creation of Temporary File With Insecure Permissions

CWE-732⁠

Incorrect Permission Assignment for Critical Resource

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-732⁠

Incorrect Permission Assignment for Critical Resource

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

CWE-200⁠

Exposure of Sensitive Information to an Unauthorized Actor

CWE-276⁠

Incorrect Default Permissions

Impacted images

Advisories
Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.

Sign in