CVE-2021-21364: Generated Code Contains Local Information Disclosure Vulnerability
First published: Thu Mar 11 2021(Updated: )
swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Smartbear Swagger-codegen | <2.4.19 |
Remedy
https://github.com/swagger-api/swagger-codegen/commit/35adbd552d5f99b3ff1e0e59da228becc85190f2
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of swagger-codegen?
The vulnerability ID of swagger-codegen is CVE-2021-21364.
What is swagger-codegen?
swagger-codegen is an open-source project that generates documentation, API clients, and server stubs from OpenAPI/Swagger definitions.
What is the severity of CVE-2021-21364?
The severity of CVE-2021-21364 is medium with a severity value of 5.5.
How does CVE-2021-21364 impact Unix-Like systems?
CVE-2021-21364 can impact Unix-Like systems by allowing an attacker to create or overwrite arbitrary files in the system's temporary directory.
How can I fix CVE-2021-21364 in swagger-codegen?
To fix CVE-2021-21364 in swagger-codegen, you should update to version 2.4.19 or higher.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/smartbear
- canonical/smartbear swagger-codegen