phildow
commented
3 years ago will be fixed with next update that bumps dep version.
Closed mend-for-github-com[bot] closed 3 years ago
phildow
commented
3 years ago will be fixed with next update that bumps dep version.
CVE-2020-8908 - Low Severity Vulnerability
Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.
Library home page: https://github.com/google/guava
Path to dependency file: tensorio-android/core/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/28.1-jre/b0e91dcb6a44ffb6221b5027e12a5cb34b841145/guava-28.1-jre.jar
Dependency Hierarchy: - lint-gradle-27.1.1.jar (Root Library) - lint-27.1.1.jar - :x: **guava-28.1-jre.jar** (Vulnerable Library)
Found in HEAD commit: 16259a8745effc31a7a75151b35d3f5a4e8fc2a7
Found in base branch: master
A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.
Publish Date: 2020-12-10
URL: CVE-2020-8908
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
Release Date: 2020-12-10
Fix Resolution: v30.0