LiRuochen_WorkFlow/MaxKey
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vuln-fix: Temporary File Information Disclosure

Browse Source 
This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18


Co-authored-by: Moderne <team@moderne.io>
This commit is contained in:
Jonathan Leitschuh
2022-11-19 02:04:21 +00:00
co-authored by Moderne
parent 3222ba7043
commit 5112a787ad
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
maxkey-common/src/main/java/org/maxkey/crypto/cert/NetUtil.java
+2 -1
View File
@@ -31,6 +31,7 @@ import java.net.MalformedURLException;
import java.net.URI;
import java.net.URL;
import java.net.URLConnection;
import java.nio.file.Files;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -140,7 +141,7 @@ public final class NetUtil
try
{
tempFile = File.createTempFile("portecle", null);
tempFile = Files.createTempFile("portecle",null).toFile();
out = new BufferedOutputStream(new FileOutputStream(tempFile));
byte[] buf = new byte[2048];
int n;