Exposure of resource to wrong sphere in Eclipse Jersey
Priority LOW 29CWE-378Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-668 and the CVSS impact.
Summary
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
Why it matters now
EPSS 0.00869 59th percentileScored 2026-11-07
Fix Partial org.glassfish.jersey.core:jersey-common (Maven): 2.34, 3.0.2Red Hat: 3 advisoriesRed Hat: 3 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jersey | 2.28 and later; up to 2.33; 3.0.0 and later; up to 3.0.1 | — | No fix listed | CNA |
| — | org.glassfish.jersey.core:jersey-common (Maven) | 2.28 to before 2.34 | 2.34 | Patch available | GHSA-c43q-5hpj-4crv |
| — | org.glassfish.jersey.core:jersey-common (Maven) | 3.0.0 to before 3.0.2 | 3.0.2 | Patch available | GHSA-c43q-5hpj-4crv |
- Eclipse Jersey VendorEclipse Foundation Affected 2.28 and later; up to 2.33; 3.0.0 and later; up to 3.0.1 Fixed in — No fix listed CNA
- org.glassfish.jersey.core:jersey-common (Maven) Vendor— Affected 2.28 to before 2.34 Fixed in 2.34 Patch available GHSA-c43q-5hpj-4crv
- org.glassfish.jersey.core:jersey-common (Maven) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-c43q-5hpj-4crv
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jersey:*:*:*:*:*:*:*:* | 2.28 to before 2.34; 3.0.0 to before 3.0.2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
- cpe:2.3:a:eclipse:jersey:*:*:*:*:*:*:*:* Versions 2.28 to before 2.34; 3.0.0 to before 3.0.2 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-c43q-5hpj-4crv org.glassfish.jersey.core:jersey-common (Maven) Fixed in 2.34 Advisory →
- Fix · GHSA-c43q-5hpj-4crv org.glassfish.jersey.core:jersey-common (Maven) Fixed in 3.0.2 Advisory →
Red Hat 3 advisories
- RHSA-2022:1029 Released 2022-03-23 · Red Hat rating ImportantRed Hat Integration Camel-K 1.6.4 release and security update
- RHINT Camel-K 1.6.4
- RHSA-2022:1013 Released 2022-03-22 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus 2.2.1 security update
- RHINT Camel-Q 2.2.1
- RHSA-2021:3225 Released 2021-08-19 · Red Hat rating ModerateRed Hat AMQ Streams 1.8.0 release and security update
- Red Hat AMQ Streams 1.8.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat Integration Service Registry | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| RHINT Camel-K 1.6.4 | Fixed | RHSA-2022:1029 |
| RHINT Camel-Q 2.2.1 | Fixed | RHSA-2022:1013 |
| Red Hat AMQ Streams 1.8.0 | Fixed | RHSA-2021:3225 |
Not affected: 4 products
- Red Hat BPM Suite 6
- Red Hat Fuse 7
- Red Hat JBoss Fuse 6
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28168
- 2026-10-03 Alias added: GHSA-c43q-5hpj-4crv
References
Advisory 3
Other 32
- [kafka-jira] 20210429 [GitHub] [kafka] xjin-Confluent opened a new pull request #10614: MINOR: Upgrade jersey to 2.34
- [kafka-jira] 20210505 [jira] [Created] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-dev] 20210505 [jira] [Created] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-jira] 20210505 [GitHub] [kafka] shayelkin opened a new pull request #10636: MINOR: Bump Jersey deps to 2.34 due to CVE-2021-28168
- [kafka-jira] 20210506 [jira] [Assigned] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-jira] 20210506 [jira] [Commented] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-jira] 20210506 [GitHub] [kafka] dongjinleekr opened a new pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-jira] 20210506 [GitHub] [kafka] omkreddy commented on pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-jira] 20210506 [GitHub] [kafka] omkreddy merged pull request #10636: MINOR: Bump Jersey deps to 2.34 due to CVE-2021-28168
- [kafka-commits] 20210506 [kafka] branch 2.7 updated: KAFKA-12752: Bump Jersey deps to 2.34 due to CVE-2021-28168 (#10636)
- [kafka-commits] 20210506 [kafka] branch 2.8 updated: KAFKA-12752: Bump Jersey deps to 2.34 due to CVE-2021-28168 (#10636)
- [kafka-jira] 20210506 [jira] [Resolved] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-dev] 20210506 [jira] [Resolved] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-jira] 20210507 [GitHub] [kafka] dongjinleekr closed pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-jira] 20210507 [GitHub] [kafka] dongjinleekr commented on pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02
- [kafka-users] 20210617 vulnerabilities
- https://lists.apache.org/thread.html/rdff6939e6c8dd620e20b013d9a35f57d42b3cd19e1d0483d85dfa2fd@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rd54b42edccc1b993853a9c4943a9b16db763f5e2febf6e64b7d0fe3c@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rc6221670de35b819fe191e7d8f2d17bc000549bd554020cec644b71e@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rc288874c330b3af9e29a1a114c5e0d24fff7a79eaa341f551535c8c0@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rafc3c4cee534f478cbf8acf91e48373e291a21151f030e8132662a7b@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/ra3d7cd37fc794981a885332af2f8df0d873753380ea19935d6d847fc@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/ra3290fe51b4546fac195724c4187c4cb7fc5809bc596c2f7e97606f4@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/ra2722171d569370a9e15147d9f3f6138ad9a188ee879c0156aa2d73a@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r96658b899fcdbf04947257d201dc5a0abdbb5fb0a8f4ec0a6c15e70f@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r6dadc8fe82071aba841d673ffadf34728bff4357796b1990a66e3af1@%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r454f38e85db149869c5a92c993c402260a4f8599bf283f6cfaada972@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r42fef440487a04cf5e487a9707ef5119d2dd5b809919f25ef4296fc4@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r4066176a7352e021d7a81af460044bde8d57f40e98f8e4a31923af3a@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r305fb82e5c005143c1e2ec986a19c0a44f42189ab2580344dc955359@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r280438f7cb4b3b1c9dfda9d7b05fa2a5cfab68618c6afee8169ecdaa@%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
More Eclipse Foundation Jersey vulnerabilities
- TI-2025-11360 Race Condition allows Bypass of Trust Restrictions CVSS 4.0CRITICAL 9.4
Sources
- CVE-2021-28168 · CVE Program
- CVE-2021-28168 · NVD
- FIRST EPSS
- GHSA-c43q-5hpj-4crv · GitHub Advisory Database · CC BY 4.0
- CVE-2021-28168 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences