QID 982833

QID 982833: Java (maven) Security Update for com.netflix.hollow:hollow (GHSA-9295-mhf3-v33m)

> ID: NFLX-2021-001
> Title: Local information disclosure in Hollow
> Release Date: 2021-03-23
> Credit: Security Researcher @JLLeitschuh

# Overview

Security researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.

# Impact

An attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.

# Description

Since the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.

# Workarounds and Fixes

Avoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

  • CVSS V3 rated as Medium - 4.4 severity.
  • CVSS V2 rated as Medium - 3.6 severity.
    • Solution
    Customers are advised to refer to GHSA-9295-mhf3-v33m for updates pertaining to this vulnerability.
    Vendor References

    CVEs related to QID 982833

    CVE-2021-28099 |
    Software Advisories
    Advisory ID Software Component Link
    GHSA-9295-mhf3-v33m com.netflix.hollow:hollow URL Logo github.com/advisories/GHSA-9295-mhf3-v33m
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].