CVE-2023-2976 json
Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
published 2023-06-14 3 y ago modified 2026-09-10 1 mo ago also GHSA-7g45-4rm6-3mm3 , EUVD-2023-1730
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Patch / fix
- maven com.google.guava:guava 32.0.0-android
- Google Guava 32.0.0
- guava-libraries Debian 14, Debian 13 32.0.1-1
debian advisories DEBIAN-CVE-2023-2976
- jenkins ocp tools 4.14 2.426.3.1706516352-3.el8
- jenkins-2-plugins ocp tools 4.14 4.14.1706516441-1.el8
- eap7-avro jboss enterprise application platform 7.4 1.11.3-1.redhat_00001.1.el7eap
- eap7-guava jboss enterprise application platform 7.4 32.1.1-2.jre_redhat_00001.1.el7eap
- eap7-jandex jboss enterprise application platform 7.4 2.4.4-1.Final_redhat_00001.1.el7eap
- eap7-yasson jboss enterprise application platform 7.4 1.0.11-4.redhat_00002.1.el7eap
- eap7-jgroups jboss enterprise application platform 7.4 4.2.23-1.Final_redhat_00001.1.el7eap
- eap7-wildfly jboss enterprise application platform 7.4 7.4.14-5.GA_redhat_00002.1.el7eap
red hat advisories RHSA-2024:0777RHSA-2023:7637RHSA-2023:7638RHSA-2023:7639RHSA-2024:0778RHSA-2024:0800
- guava Manager Server Module 4.3 32.0.1-150400.3.3.1
- guava SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 32.0.1-150200.3.7.1
suse advisories SUSE-SU-2024:1138-1SUSE-SU-2023:3090-1
- guava openSUSE Tumbleweed 32.0.1-1.1
opensuse advisories openSUSE-SU-2024:13001-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-2976 updated cvss 4.4
guava: insecure temporary directory creation
-
Red Hat Migration Toolkit for Runtimes org.jboss.windup-windup-parentaffected: workaround, no fix available “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.”
-
Red Hat A-MQ Online guavaaffected: workaround, no fix planned “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.”
-
Red Hat build of Apache Camel for Spring Boot 3 guava Red Hat build of Apicurio Registry 2 guavaaffected: workaround, no fix available “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.”
-
Red Hat build of Debezium 1 guava Red Hat build of OptaPlanner 8 guava Red Hat Decision Manager 7 guava Red Hat Enterprise Linux 7 guava, guava-javadoc Red Hat Enterprise Linux 8 guava, guava-javadoc, guava-testlib Red Hat Enterprise Linux 9 guava, guava-javadoc, guava-testlibaffected: workaround, no fix planned “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.”
+8 more productsfewer
Red Hat Fuse 7 guava Red Hat Integration Camel K 1 guava Red Hat Integration Camel Quarkus 2 guava Red Hat JBoss Data Grid 7 guava Red Hat JBoss Data Virtualization 6 guava Red Hat JBoss Enterprise Application Platform 6 guava Red Hat JBoss Fuse 6 guava Red Hat JBoss Fuse Service Works 6 guava -
Red Hat OpenShift Container Platform 4 jenkins, jenkins-2-pluginsaffected: workaround, no fix available “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.”
-
Red Hat OpenStack Platform 13 (Queens) guava Red Hat Process Automation 7 guavaaffected: workaround, no fix planned “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.”
-
Red Hat AMQ Broker 7.11.2fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:5491
-
Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-41fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:0801
show 17 moreshow fewer
-
Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.2-2, mta/mta-hub-rhel9 6.2.2-2, mta/mta-rhel8-operator 6.2.2-3, mta/mta-operator-bundle 6.2.2-5, mta/mta-pathfinder-rhel9 6.2.2-2, mta/mta-windup-addon-rhel9 6.2.2-3fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:1027
-
Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.426.3.1706515686-3.el8, jenkins-2-plugins 4.12.1706515741-1.el8fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:0778
-
Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins 4.14.1706516441-1.el8fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:0777
-
Red Hat AMQ Streams 2.5.0fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:5165
-
Red Hat AMQ Streams 2.6.0fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:7678
-
Red Hat AMQ Streams 2.7.0fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:3527
-
Red Hat build of Apache Camel 4.4.0 for Spring Bootfixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:2707
-
Red Hat build of Quarkus 2.13.9fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:7700
-
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-guava 32.1.1-2.jre_redhat_00001.1.el7eap, eap7-guava-libraries 32.1.1-2.jre_redhat_00001.1.el7eapfixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:7637
-
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-guava 32.1.1-2.jre_redhat_00001.1.el8eap, eap7-guava-libraries 32.1.1-2.jre_redhat_00001.1.el8eapfixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:7638
-
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-guava 32.1.1-2.jre_redhat_00001.1.el9eap, eap7-guava-libraries 32.1.1-2.jre_redhat_00001.1.el9eapfixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:7639
-
Red Hat JBoss Enterprise Application Platform guava 32.1.1.jre-redhat-00001fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2023:7641
-
Red Hat Single Sign-On 7fixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:0804
-
Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.12-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.12-1.redhat_00001.1.el7ssofixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:0798
-
Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.12-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.12-1.redhat_00001.1.el8ssofixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:0799
-
Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.12-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.12-1.redhat_00001.1.el9ssofixed: vendor fix “Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.” RHSA-2024:0800
-
Red Hat A-MQ Clients 2 guavanot affected: vulnerable code not present
13 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CISA ADP | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.google.guava:guava | >=1.0, <32.0.0-android |
32.0.0-android |
Affected products
- Google Guava
Classification
References
-
github.com
/google/guava/issues/2575
web, issue-tracking, patch, vendor-advisory
-
github.com
/google/guava/commit/feb83a1c8fd2e7670b244d5afd23cba5aca43284
web
- security.netapp.com /advisory/ntap-20230818-0008/
-
intel.com
/content/www/us/en/security-center/advisory/intel-sa-01006.html
web
- security.netapp.com /advisory/ntap-20241108-0002/
-
nvd.nist.gov
/vuln/detail/CVE-2023-2976
advisory
-
github.com
/google/guava/issues/6532
web
-
github.com
/google/guava
package
-
github.com
/google/guava/releases/tag/v32.0.0
web
-
security.netapp.com
/advisory/ntap-20230818-0008
web
-
security.netapp.com
/advisory/ntap-20241108-0002
web
Sources
- CVE List CVE-2023-2976
- GitHub Advisory GHSA-7g45-4rm6-3mm3
- NVD CVE-2023-2976
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.