Homepage
About Snyk

Incorrect Permission Assignment for Critical Resource Affecting trino package, versions <439-r0

Severity

 Recommended
0.0
low
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    0.06% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-WOLFILATEST-TRINO-6249438
  • published 16 Feb 2024
  • disclosed 10 Dec 2020
Report a new vulnerability Found a mistake?

Introduced: 10 Dec 2020

CVE-2020-8908 Open this link in a new tab
CWE-732 Open this link in a new tab

How to fix?

Upgrade Wolfi trino to version 439-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream trino package and not the trino package as distributed by Wolfi. See How to fix? for Wolfi relevant fixed versions and status.

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

References

CVSS Scores

version 3.1
Expand this section

NVD

Recommended
3.3 low
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

SUSE

4 medium
Expand this section

Red Hat

3.3 low