What is GHSA-j75r-vf64-6rrh?

GHSA-j75r-vf64-6rrh is a security advisory published by GitHub Security Advisories with Low severity. RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions

Which CVE IDs does GHSA-j75r-vf64-6rrh cover?

GHSA-j75r-vf64-6rrh covers the following CVE IDs: CVE-2023-0481. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j75r-vf64-6rrh?

GHSA-j75r-vf64-6rrh has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

Which products are affected by GHSA-j75r-vf64-6rrh?

GHSA-j75r-vf64-6rrh affects 1 product, including: maven/io.quarkus.resteasy.reactive:resteasy-reactive-common:\u003c 3.0.0.Alpha4.

GHSA-j75r-vf64-6rrhLowCVSS 3.3

RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions

Vendor

GitHub Security Advisories

Published

February 24, 2023

Last Modified

November 16, 2023

🔗 CVE IDs covered (1)

CVE-2023-0481 →

📋 Description

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.

🎯 Affected products1

maven/io.quarkus.resteasy.reactive:resteasy-reactive-common:< 3.0.0.Alpha4

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-0481
https://github.com/quarkusio/quarkus/pull/30694
https://github.com/quarkusio/quarkus/commit/95d5904f7cf18c8165b97d8ca03b203d7f69c17e
https://github.com/advisories/GHSA-j75r-vf64-6rrh