CVE-2022-24913 Java Merge-sort Insecure Temporary File vulnerability
An attacker can read temporary file contents due to insecure file creation in the java-merge-sort library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24913?
CVE-2022-24913 is a medium-severity vulnerability in com.fasterxml.util:java-merge-sort, published on 12 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
Which versions are affected by CVE-2022-24913?
2 open source packages ship an affected version, including com.fasterxml.util:java-merge-sort. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.util:java-merge-sort Maven | All versions | 1.1.0 |
com.fasterxml.util:java-merge-sort Maven | All versions | 1.1.0 |
Products include Java-Merge-Sort Project Java-Merge-Sort.
How do I fix CVE-2022-24913?
Upgrade com.fasterxml.util:java-merge-sort to 1.1.0 or later.
Is CVE-2022-24913 being exploited?
There is no known exploitation of CVE-2022-24913 in the wild and no public exploit code.
Sources
Also known as GHSA-qxxc-7mq4-mf79.