CVE-2020-8908: Temp directory permission issue in Guava

Published Sep 8, 2020
·
Updated

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.

Other sources

A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.

Reference: https://github.com/google/guava/issues/4011

Upstream patch: https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40

— Red Hat

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

Apache HttpComponents Client could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view files on the system.

— IBM

Affected Software

76 affected componentsFixes available
redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el6ea
0:2.9.0-9.redhat_00019.1.el6ea
redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el6ea
0:1.68.0-1.redhat_00001.1.el6ea
redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el6ea
0:1.0.1-1.redhat_00002.1.el6ea
redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el6ea
0:30.1.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el6ea
0:3.2.13-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el6ea
0:1.4.27-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.39-1.SP1_redhat_00001.1.el6ea
0:4.0.39-1.SP1_redhat_00001.1.el6ea
redhat/eap7-jboss-logmanager<0:2.1.18-1.Final_redhat_00001.1.el6ea
0:2.1.18-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-remoting<0:5.0.20-2.SP1_redhat_00001.1.el6ea
0:5.0.20-2.SP1_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-5.Final_redhat_00006.1.el6ea
0:1.7.2-5.Final_redhat_00006.1.el6ea
redhat/eap7-narayana<0:5.9.11-1.Final_redhat_00001.1.el6ea
0:5.9.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.34-1.SP1_redhat_00001.1.el6ea
0:2.0.34-1.SP1_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.6-1.GA_redhat_00002.1.el6ea
0:7.3.6-1.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.11-1.Final_redhat_00001.1.el6ea
0:1.10.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.25-1.Final_redhat_00001.1.el6ea
0:1.0.25-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-naming-client<0:1.0.14-1.Final_redhat_00001.1.el6ea
0:1.0.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el7ea
0:2.9.0-9.redhat_00019.1.el7ea
redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el7ea
0:1.68.0-1.redhat_00001.1.el7ea
redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el7ea
0:1.0.1-1.redhat_00002.1.el7ea
redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el7ea
0:30.1.0-1.redhat_00001.1.el7ea
redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el7ea
0:3.2.13-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el7ea
0:1.4.27-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.39-1.SP1_redhat_00001.1.el7ea
0:4.0.39-1.SP1_redhat_00001.1.el7ea
redhat/eap7-jboss-logmanager<0:2.1.18-1.Final_redhat_00001.1.el7ea
0:2.1.18-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-remoting<0:5.0.20-2.SP1_redhat_00001.1.el7ea
0:5.0.20-2.SP1_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-5.Final_redhat_00006.1.el7ea
0:1.7.2-5.Final_redhat_00006.1.el7ea
redhat/eap7-narayana<0:5.9.11-1.Final_redhat_00001.1.el7ea
0:5.9.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.34-1.SP1_redhat_00001.1.el7ea
0:2.0.34-1.SP1_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.6-1.GA_redhat_00002.1.el7ea
0:7.3.6-1.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.11-1.Final_redhat_00001.1.el7ea
0:1.10.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client<0:1.0.25-1.Final_redhat_00001.1.el7ea
0:1.0.25-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-naming-client<0:1.0.14-1.Final_redhat_00001.1.el7ea
0:1.0.14-1.Final_redhat_00001.1.el7ea
redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el8ea
0:2.9.0-9.redhat_00019.1.el8ea
redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el8ea
0:1.68.0-1.redhat_00001.1.el8ea
redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el8ea
0:1.0.1-1.redhat_00002.1.el8ea
redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el8ea
0:30.1.0-1.redhat_00001.1.el8ea
redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el8ea
0:3.2.13-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el8ea
0:1.4.27-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.39-1.SP1_redhat_00001.1.el8ea
0:4.0.39-1.SP1_redhat_00001.1.el8ea
redhat/eap7-jboss-logmanager<0:2.1.18-1.Final_redhat_00001.1.el8ea
0:2.1.18-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-remoting<0:5.0.20-2.SP1_redhat_00001.1.el8ea
0:5.0.20-2.SP1_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-5.Final_redhat_00006.1.el8ea
0:1.7.2-5.Final_redhat_00006.1.el8ea
redhat/eap7-narayana<0:5.9.11-1.Final_redhat_00001.1.el8ea
0:5.9.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.34-1.SP1_redhat_00001.1.el8ea
0:2.0.34-1.SP1_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.6-1.GA_redhat_00002.1.el8ea
0:7.3.6-1.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.11-1.Final_redhat_00001.1.el8ea
0:1.10.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.0.25-1.Final_redhat_00001.1.el8ea
0:1.0.25-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-naming-client<0:1.0.14-1.Final_redhat_00001.1.el8ea
0:1.0.14-1.Final_redhat_00001.1.el8ea
redhat/candlepin<0:4.0.9-1.el7
0:4.0.9-1.el7
maven/com.google.guava:guava<32.0.0-android
32.0.0-android
Google Guava<32.0.0
Quarkus Quarkus<1.11.4
Oracle Commerce Guided Search=11.3.2
Oracle Communications Cloud Native Core Network Slice Selection Function=1.2.1
Oracle Communications Pricing Design Center=12.0.0.4.0
Oracle Communications Pricing Design Center=12.0.0.5.0
Oracle Data Integrator=12.2.1.3.0
Oracle Data Integrator=12.2.1.4.0
Oracle Nosql Database<20.3
Oracle PeopleSoft Enterprise PeopleTools=8.57
Oracle PeopleSoft Enterprise PeopleTools=8.58
Oracle PeopleSoft Enterprise PeopleTools=8.59
Oracle Retail Customer Management and Segmentation Foundation>=16.0<=19.0
Oracle WebLogic Server=14.1.1.0.0
Oracle Communications Cloud Native Core Network Repository Function=1.14.0
Oracle Primavera Unifier>=17.7<=17.12
Oracle Primavera Unifier=18.8
Oracle Primavera Unifier=19.12
Oracle Primavera Unifier=20.12
Oracle Primavera Unifier=21.12
NetApp Active Iq Unified Manager Linux
NetApp Active Iq Unified Manager Vmware Vsphere
NetApp Active Iq Unified Manager Windows
redhat/guava<30.0
30.0
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.7.2.1 - 9.7.2.11
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.6.1.1 - 9.6.1.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-9.redhat_00019.1.el6ea
  2. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-1.redhat_00001.1.el6ea
  3. Upgrade

    Upgrade redhat/eap7-guava-failureaccess to a version that resolves this vulnerability.

    Fixed in 0:1.0.1-1.redhat_00002.1.el6ea
  4. Upgrade

    Upgrade redhat/eap7-guava-libraries to a version that resolves this vulnerability.

    Fixed in 0:30.1.0-1.redhat_00001.1.el6ea
  5. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.13-1.Final_redhat_00001.1.el6ea
  6. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.27-1.Final_redhat_00001.1.el6ea
  7. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.39-1.SP1_redhat_00001.1.el6ea
  8. Upgrade

    Upgrade redhat/eap7-jboss-logmanager to a version that resolves this vulnerability.

    Fixed in 0:2.1.18-1.Final_redhat_00001.1.el6ea
  9. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-2.SP1_redhat_00001.1.el6ea
  10. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-5.Final_redhat_00006.1.el6ea
  11. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.11-1.Final_redhat_00001.1.el6ea
  12. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.34-1.SP1_redhat_00001.1.el6ea
  13. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.6-1.GA_redhat_00002.1.el6ea
  14. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.11-1.Final_redhat_00001.1.el6ea
  15. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.25-1.Final_redhat_00001.1.el6ea
  16. Upgrade

    Upgrade redhat/eap7-wildfly-naming-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.14-1.Final_redhat_00001.1.el6ea
  17. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-9.redhat_00019.1.el7ea
  18. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-1.redhat_00001.1.el7ea
  19. Upgrade

    Upgrade redhat/eap7-guava-failureaccess to a version that resolves this vulnerability.

    Fixed in 0:1.0.1-1.redhat_00002.1.el7ea
  20. Upgrade

    Upgrade redhat/eap7-guava-libraries to a version that resolves this vulnerability.

    Fixed in 0:30.1.0-1.redhat_00001.1.el7ea
  21. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.13-1.Final_redhat_00001.1.el7ea
  22. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.27-1.Final_redhat_00001.1.el7ea
  23. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.39-1.SP1_redhat_00001.1.el7ea
  24. Upgrade

    Upgrade redhat/eap7-jboss-logmanager to a version that resolves this vulnerability.

    Fixed in 0:2.1.18-1.Final_redhat_00001.1.el7ea
  25. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-2.SP1_redhat_00001.1.el7ea
  26. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-5.Final_redhat_00006.1.el7ea
  27. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.11-1.Final_redhat_00001.1.el7ea
  28. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.34-1.SP1_redhat_00001.1.el7ea
  29. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.6-1.GA_redhat_00002.1.el7ea
  30. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.11-1.Final_redhat_00001.1.el7ea
  31. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.25-1.Final_redhat_00001.1.el7ea
  32. Upgrade

    Upgrade redhat/eap7-wildfly-naming-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.14-1.Final_redhat_00001.1.el7ea
  33. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-9.redhat_00019.1.el8ea
  34. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-1.redhat_00001.1.el8ea
  35. Upgrade

    Upgrade redhat/eap7-guava-failureaccess to a version that resolves this vulnerability.

    Fixed in 0:1.0.1-1.redhat_00002.1.el8ea
  36. Upgrade

    Upgrade redhat/eap7-guava-libraries to a version that resolves this vulnerability.

    Fixed in 0:30.1.0-1.redhat_00001.1.el8ea
  37. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.13-1.Final_redhat_00001.1.el8ea
  38. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.27-1.Final_redhat_00001.1.el8ea
  39. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.39-1.SP1_redhat_00001.1.el8ea
  40. Upgrade

    Upgrade redhat/eap7-jboss-logmanager to a version that resolves this vulnerability.

    Fixed in 0:2.1.18-1.Final_redhat_00001.1.el8ea
  41. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-2.SP1_redhat_00001.1.el8ea
  42. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-5.Final_redhat_00006.1.el8ea
  43. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.11-1.Final_redhat_00001.1.el8ea
  44. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.34-1.SP1_redhat_00001.1.el8ea
  45. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.6-1.GA_redhat_00002.1.el8ea
  46. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.11-1.Final_redhat_00001.1.el8ea
  47. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.25-1.Final_redhat_00001.1.el8ea
  48. Upgrade

    Upgrade redhat/eap7-wildfly-naming-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.14-1.Final_redhat_00001.1.el8ea
  49. Upgrade

    Upgrade redhat/candlepin to a version that resolves this vulnerability.

    Fixed in 0:4.0.9-1.el7
  50. Upgrade

    Upgrade maven/com.google.guava:guava to a version that resolves this vulnerability.

    Fixed in 32.0.0-android
  51. Upgrade

    Upgrade redhat/guava to a version that resolves this vulnerability.

    Fixed in 30.0
  52. Upgrade

    Upgrade google/guava to a version that resolves this vulnerability.

    Fixed in 30.0
  53. Upgrade

    Upgrade google/guava to a version that resolves this vulnerability.

    Fixed in 32.0.0
  54. Configuration

    Stop using Guava com.google.common.io.Files.createTempDir() (deprecated in 30.0+) and migrate to the Java 7 API java.nio.file.Files.createTempDirectory() or configure directory permissions explicitly after creation.

    Guava com.google.common.io.Files.createTempDir() Use of deprecated temp directory API = Do not use (method marked @Deprecated in 30.0 and later)
  55. Configuration

    Configure the Java runtime system property java.io.tmpdir to a temp directory path with appropriately configured permissions (instead of default /tmp world-readable permissions).

    Java runtime java.io.tmpdir = Point to a location whose permissions are appropriately configured
  56. Configuration

    After creating the temporary directory, explicitly change its permissions so it is not world-readable; alternatively remove uses of the vulnerable method.

    Guava com.google.common.io.Files.createTempDir() Temporary directory permissions = Explicitly change after creation
  57. Compensating control

    For Android, use an Android-provided temporary directory API such as context.getCacheDir() instead of Guava's createTempDir().

  58. Compensating control

    For remote traversal risk mentioned (Apache HttpComponents Client), ensure proper validation of user requests is in place to prevent directory traversal (e.g., reject dot-dot sequences /../ used in crafted URL requests).

Event History

Sep 8, 2020
CVE Published
12:00 AM
Dec 10, 2020
CVE Published
via MITRE·10:10 PM
Data Sourced
via MITRE·10:10 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 11, 2020
Data Sourced
via Red Hat·07:07 PM
DescriptionSeverityAffected Software
Mar 25, 2021
Advisory Published
05:04 PM
Jul 6, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-8908?

CVE-2020-8908 has been assigned a medium severity level due to its potential for information exposure.

2

How do I fix CVE-2020-8908?

To fix CVE-2020-8908, upgrade to Guava version 30.0 or later.

3

What versions of Guava are affected by CVE-2020-8908?

CVE-2020-8908 affects Guava versions prior to 30.0.

4

What type of vulnerability is CVE-2020-8908?

CVE-2020-8908 is a temporary directory creation vulnerability that may allow local users to access sensitive information.

5

Which software packages are affected by CVE-2020-8908?

Several Red Hat packages including eap7-activemq-artemis and eap7-bouncycastle are affected by CVE-2020-8908.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203