QID 980062

Security update has been released for junit:junit to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

This vulnerability **does not** allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability.

When analyzing the impact of this vulnerability, here are the important questions to ask:

1. Do the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder?
- If yes, this vulnerability impacts you, but only if you also answer 'yes' to question 2.
- If no, this vulnerability does not impact you.
2. Do the JUnit tests ever execute in an environment where the OS has other untrusted users.
_This may apply in CI/CD environments but normally won't be 'yes' for personal developer machines._
- If yes, and you answered 'yes' to question 1, this vulnerability impacts you.
- If no, this vulnerability does not impact you.