CVE-2023-2976 Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
Local attackers can read sensitive files created by Guava's FileBackedOutputStream due to insecure temporary directory usage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2976?
CVE-2023-2976 is a medium-severity vulnerability in Google Guava, published on 14 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Weakness: CWE-552
Which versions are affected by CVE-2023-2976?
2 open source packages ship an affected version, including com.google.guava:guava. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.google.guava:guava Maven | From 1.0 | 32.0.0-android |
com.google.guava:guava Maven | From 1.0 | 32.0.0-android |
Linux distribution packages (1)
guava openSUSE:Tumbleweed | All versions | 32.0.1-1.1 |
Products include Google Guava.
How do I fix CVE-2023-2976?
Upgrade com.google.guava:guava to 32.0.0-android or later.
Is CVE-2023-2976 being exploited?
There is no known exploitation of CVE-2023-2976 in the wild and no public exploit code.
Other vulnerabilities in Google Guava
Sources
Also known as AZL-27173, AZL-43696, CLEANSTART-2026-BX78459, CLEANSTART-2026-CK79983, CLEANSTART-2026-NL20798, CLEANSTART-2026-SF12674 and 26 more.