CVE-2021-21429: Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. OpenAPI Generator maven plug-in creates insecure temporary files during the process. The issue has been patched with Files.createTempFile and released in the v5.1.0 stable version.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21429?
CVE-2021-21429 has a medium severity level due to the potential for insecure temporary file vulnerabilities.
How do I fix CVE-2021-21429?
To fix CVE-2021-21429, upgrade OpenAPI Generator to a version greater than 5.1.0.
What applications are affected by CVE-2021-21429?
CVE-2021-21429 affects all versions of OpenAPI Generator prior to 5.1.0.
What is the cause of CVE-2021-21429?
CVE-2021-21429 is caused by the use of 'File.createTempFile' in JDK, leading to insecure creation of temporary files.
What impact does CVE-2021-21429 have on system security?
CVE-2021-21429 can lead to exposure of sensitive application and system data due to insecure temporary file handling.