CVE-2021-23331
Summary
| CVE | CVE-2021-23331 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-02-03 18:15:00 UTC |
| Updated | 2022-04-08 13:36:00 UTC |
| Description | This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| N/A | CONFIRM | github.com | Broken Link |
| Insecure Temporary File in com.squareup:connect | Snyk | CONFIRM | snyk.io | Third Party Advisory |
| connect-java-sdk/ApiClient.java at master · square/connect-java-sdk · GitHub | MITRE | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Jonathan Leitschuh
Legacy QID Mappings
- 982228 Java (maven) Security Update for com.squareup:connect (GHSA-q4hm-fwc9-hmv6)