Read the docs
TI-2020-07155 Aliases CVE-2020-8908GHSA-5mg8-w23w-74h3

Temp directory permission issue in Guava

Priority LOW 18CWE-378Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 10 fixed, 23 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00924 60th percentileScored 2026-11-07
Fix Partial Guava (Google LLC): 32.0com.google.guava:guava (Maven): 32.0.0-androidRed Hat: 10 advisoriesRed Hat: 10 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleGuava1.0 to before 32.032.0Patch availableCNA
—com.google.guava:guava (Maven)before 32.0.0-android32.0.0-androidPatch availableGHSA-5mg8-w23w-74h3
  • Guava VendorGoogle Affected 1.0 to before 32.0 Fixed in 32.0 Patch available CNA
  • com.google.guava:guava (Maven) Vendor— Affected before 32.0.0-android Fixed in 32.0.0-android Patch available GHSA-5mg8-w23w-74h3

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:google:guava:*:*:*:*:*:*:*:*before 32.0.0VulnerableGoogle
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 1.11.4Vulnerablequarkusio
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*12.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0:*:*:*:*:*:*:*12.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*before 20.3VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
  • cpe:2.3:a:google:guava:*:*:*:*:*:*:*:* Versions before 32.0.0 Vulnerable ·Google
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 1.11.4 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:* Versions 12.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0:*:*:*:*:*:*:* Versions 12.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* Versions before 20.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*16.0 – 19.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* Versions 16.0 – 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA Guava (Google LLC) Fixed in 32.0
  • Fix · GHSA-5mg8-w23w-74h3 com.google.guava:guava (Maven) Fixed in 32.0.0-android Advisory →

Red Hat 10 advisories

  • RHSA-2022:1029 Released 2022-03-23 · Red Hat rating Important
    Red Hat Integration Camel-K 1.6.4 release and security update
    • RHINT Camel-K 1.6.4
  • RHSA-2022:1013 Released 2022-03-22 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update
    • RHINT Camel-Q 2.2.1
  • RHSA-2021:4702 Released 2021-11-16 · Red Hat rating Moderate
    Satellite 6.10 Release
    • Red Hat Satellite 6.10 candlepin-4.0.9-1.el7sat, foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc +14
    • Red Hat Satellite Capsule 6.10 foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc, python-ecdsa-0.13.3-2.el7pc +9
Show 7 more Red Hat advisories
  • RHSA-2021:2210 Released 2021-06-02 · Red Hat rating Moderate
    EAP XP 1 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP via EAP 7.3.x base
  • RHSA-2021:0974 Released 2021-03-23 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.6 security update
    • Red Hat Single Sign-On 7.4.6
  • RHSA-2021:0872 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el6eap +47
  • RHSA-2021:0874 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el8eap +47
  • RHSA-2021:0873 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el7eap +47
  • RHSA-2021:0885 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2021:0417 Released 2021-02-04 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8.1 release and security update
    • Red Hat AMQ 7.8.1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Integration Service RegistryAffectedNo fix yet: Fix deferred
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat build of QuarkusAffectedNo fix yet: Fix deferred
RHINT Camel-K 1.6.4Fixed RHSA-2022:1029
RHINT Camel-Q 2.2.1Fixed RHSA-2022:1013
Red Hat AMQ 7.8.1Fixed RHSA-2021:0417
Red Hat EAP-XP via EAP 7.3.x baseFixed RHSA-2021:2210
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0874
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0872
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0873
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0885
Red Hat Satellite 6.10Fixed RHSA-2021:4702
Red Hat Single Sign-On 7.4.6Fixed RHSA-2021:0974
Not affected: 5 products
  • Red Hat Decision Manager 7
  • Red Hat Process Automation 7
  • Red Hat Satellite 6.10
  • Red Hat Satellite Capsule 6.10
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8908
  2. 2026-10-03 Alias added: GHSA-5mg8-w23w-74h3
  3. 2026-11-02 CISA SSVC decision points changed

References

Patch 6

Advisory 37

Other 39

  • TI-2018-07261 Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote… CVSS 3.1MEDIUM 5.9
  • TI-2023-02788 Use of temporary directory for file creation in `FileBackedOutputStream` in Guava CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences