Homepage
About Snyk

Incorrect Permission Assignment for Critical Resource Affecting apache-nifi package, versions <1.26.0-r2

Severity

 Recommended
0.0
low
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    0.06% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CHAINGUARDLATEST-APACHENIFI-6861978
  • published 17 May 2024
  • disclosed 10 Dec 2020
Report a new vulnerability Found a mistake?

Introduced: 10 Dec 2020

CVE-2020-8908 Open this link in a new tab
CWE-732 Open this link in a new tab

How to fix?

Upgrade Chainguard apache-nifi to version 1.26.0-r2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache-nifi package and not the apache-nifi package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

References

CVSS Scores

version 3.1
Expand this section

NVD

Recommended
3.3 low
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

SUSE

4 medium
Expand this section

Red Hat

3.3 low