Closed renovate[bot] closed 8 months ago
Because you closed this PR without merging, Renovate will ignore this update (4.13.1
). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps
array of your Renovate config.
If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
This PR contains the following updates:
4.11
->4.13.1
4.12
->4.13.1
4.8.2
->4.13.1
GitHub Vulnerability Alerts
CVE-2020-15250
Vulnerability
The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability.
Example of vulnerable code:
Impact
On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.
This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability.
When analyzing the impact of this vulnerability, here are the important questions to ask:
Patches
Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using.
Workarounds
If you are unable to patch, or are stuck running on Java 1.6, specifying the
java.io.tmpdir
system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability.References
Similar Vulnerabilities
For more information
If you have any questions or comments about this advisory, please pen an issue in junit-team/junit4.
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Zurich, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled because a matching PR was automerged previously.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate. View repository job log here.