Skip to content
Fencer Vulns
low 3.3

CVE-2020-8908 json

Temp directory permission issue in Guava

published 2020-12-10 5 y ago modified 2026-11-02 6 d ago also GHSA-5mg8-w23w-74h3 , EUVD-2021-0611

cvss
3.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Patch / fix

  • maven com.google.guava:guava 32.0.0-android
  • Google LLC Guava 32.0
  • guava-libraries Debian 14, Debian 13 32.0.1-1

debian advisories DEBIAN-CVE-2020-8908

  • foreman satellite capsule 6.10, satellite 6.10 2.5.2.17-2.el7sat
  • candlepin satellite 6.10 4.0.9-1.el7sat
  • satellite satellite capsule 6.10, satellite 6.10 6.10.0-3.el7sat
  • python-ecdsa satellite capsule 6.10, satellite 6.10 0.13.3-2.el7pc
  • python-pyyaml satellite capsule 6.10, satellite 6.10 5.4.1-1.el7pc
  • python3-ecdsa satellite capsule 6.10, satellite 6.10 0.13.3-2.el7pc
  • python-aiohttp satellite capsule 6.10, satellite 6.10 3.7.4-1.el7pc
  • python-urllib3 satellite capsule 6.10, satellite 6.10 1.26.5-1.el7pc

red hat advisories RHSA-2021:4702RHSA-2021:0873RHSA-2021:0874RHSA-2021:0872

  • guava Manager Server Module 4.3 32.0.1-150400.3.3.1
  • guava SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 32.0.1-150200.3.7.1

suse advisories SUSE-SU-2024:1138-1SUSE-SU-2023:3090-1

  • guava openSUSE Tumbleweed 30.1.1-1.2

opensuse advisories openSUSE-SU-2024:10835-1

  • guava CBL-Mariner 2.0 25.0-7

azure linux advisories AZL-25952

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8908 updated cvss 3.3

guava: local information disclosure via temporary directory created with unsafe permissions

  • Red Hat build of Quarkus guava
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 guava, guava-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 guava, guava20, guava-javadoc, guava-testlib, guava20-javadoc, guava20-testlib Red Hat Fuse 7 guava Red Hat Integration Camel K 1 guava
    affected: no fix available “Fix deferred”
  • Red Hat Integration Camel Quarkus 1 guava
    affected: no fix available
  • Red Hat Integration Service Registry guava
    affected: no fix available “Fix deferred”
  • Red Hat JBoss A-MQ 6 guava Red Hat JBoss BRMS 5 guava Red Hat JBoss BRMS 6 guava Red Hat JBoss Data Grid 7 guava Red Hat JBoss Data Virtualization 6 guava Red Hat JBoss Enterprise Application Platform 6 guava
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack guava
    affected: no fix available
  • Red Hat JBoss Fuse 6 guava Red Hat JBoss Fuse Service Works 6 guava Red Hat JBoss Operations Network 3 guava
    affected: no fix planned “Out of support scope”
show 16 more
  • Red Hat OpenShift Application Runtimes guava
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 jenkins, openshift3/ose-logging-elasticsearch5 Red Hat OpenShift Container Platform 4 jenkins, openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5, openshift4/ose-logging-elasticsearch6
    affected: no fix available “Fix deferred”
  • Red Hat OpenStack Platform 10 (Newton) opendaylight
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: no fix planned “Will not fix”
  • Red Hat Software Collections rh-maven36-guava, rh-maven36-guava-javadoc, rh-maven36-guava-testlib
    affected: no fix available “Fix deferred”
  • Red Hat AMQ 7.8.1
    fixed: vendor fix RHSA-2021:0417
  • Red Hat EAP-XP via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:2210
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-guava 30.1.0-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.6-1.GA_redhat_00002.1.el8eap, eap7-bouncycastle 1.68.0-1.redhat_00001.1.el8eap, eap7-undertow 2.0.34-1.SP1_redhat_00001.1.el8eap, eap7-narayana 5.9.11-1.Final_redhat_00001.1.el8eap, eap7-activemq-artemis 2.9.0-9.redhat_00019.1.el8eap, +75 more
    fixed: vendor fix RHSA-2021:0874
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-guava 30.1.0-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.6-1.GA_redhat_00002.1.el6eap, eap7-bouncycastle 1.68.0-1.redhat_00001.1.el6eap, eap7-undertow 2.0.34-1.SP1_redhat_00001.1.el6eap, eap7-narayana 5.9.11-1.Final_redhat_00001.1.el6eap, eap7-activemq-artemis 2.9.0-9.redhat_00019.1.el6eap, +75 more
    fixed: vendor fix RHSA-2021:0872
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-guava 30.1.0-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.6-1.GA_redhat_00002.1.el7eap, eap7-bouncycastle 1.68.0-1.redhat_00001.1.el7eap, eap7-undertow 2.0.34-1.SP1_redhat_00001.1.el7eap, eap7-narayana 5.9.11-1.Final_redhat_00001.1.el7eap, eap7-activemq-artemis 2.9.0-9.redhat_00019.1.el7eap, +77 more
    fixed: vendor fix RHSA-2021:0873
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2021:0885
  • Red Hat Satellite 6.10 candlepin 4.0.9-1.el7sat
    fixed: vendor fix RHSA-2021:4702
  • Red Hat Single Sign-On 7.4.6
    fixed: vendor fix RHSA-2021:0974
  • Red Hat RHINT Camel-K 1.6.4
    fixed: vendor fix RHSA-2022:1029
  • Red Hat RHINT Camel-Q 2.2.1
    fixed: vendor fix RHSA-2022:1013
  • Red Hat Decision Manager 7 guava Red Hat Process Automation 7 guava Red Hat Satellite 6.10 tfm 7.0-1.el7sat, gofer 2.12.5-7.el7sat, katello 4.1.1-2.el7sat, libsolv 0.7.20-1.el7pc, receptor 0.6.4-2.el7ar, libcomps 0.1.15-1.el7pc, +581 more Red Hat Satellite Capsule 6.10 tfm 7.0-1.el7sat, katello 4.1.1-2.el7sat, libsolv 0.7.20-1.el7pc, libcomps 0.1.15-1.el7pc, python-rq 1.8.1-1.el7pc, python-idna 2.10-1.el7pc, +355 more Red Hat streams for Apache Kafka guava
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 d ago

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • snyk.io https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven com.google.guava:guava
<32.0.0-android
32.0.0-android

Affected products

  • Google LLC Guava

Classification

Weakness
  • CWE-378 Creation of Temporary File With Insecure Permissions
  • CWE-732 Incorrect Permission Assignment for Critical Resource
  • CWE-173 Improper Handling of Alternate Encoding
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.