Read the docs
TI-2021-10142 Aliases CVE-2021-29429

Information disclosure through temporary directory permissions

Priority LOW 25CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system temporary directory first. Sensitive information contained in these files can be exposed to other local users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By default, this directory is restricted to the user running the build. As a workaround, set a more restrictive umask that removes read access to other users. When files are created in the system temporary directory, they will not be accessible to other users. If you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00484 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial gradle (gradle): 7.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gradlegradlebefore 7.07.0Patch availableCNA
  • gradle Vendorgradle Affected before 7.0 Fixed in 7.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*before 7.0Vulnerablegradle
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 2.2.3Vulnerablequarkusio
  • cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:* Versions before 7.0 Vulnerable ·gradle
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 2.2.3 Vulnerable ·quarkusio

Remediation

  • Fix · CNA gradle (gradle) Fixed in 7.0

Red Hat 2 advisories

  • RHSA-2022:4623 Released 2022-05-18 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.7.5 release and security update
    • Red Hat build of Quarkus 2.7.5
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat build of QuarkusAffectedNo fix yet
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat build of Quarkus 2.7.5Fixed RHSA-2022:4623
Not affected: 3 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel Quarkus 1
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29429
  2. 2026-10-08 CISA SSVC decision points changed

References

Exploit 1

Advisory 1

  • TI-2016-05320 ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code… CVSS 3.0CRITICAL 9.8
  • TI-2020-09639 Injection in Apache Ant CVSS 3.1HIGH 7.5
  • TI-2019-11237 The HTTP client in Gradle before 5.6 sends authentication credentials originally destined… CVSS 3.1CRITICAL 9.8
  • TI-2021-12419 Arbitrary code execution via specially crafted environment variables CVSS 3.1HIGH 7.5
  • TI-2023-11286 Gradle usage of long IDs for PGP keys opens potential for collision attacks CVSS 3.1CRITICAL 9.8
  • TI-2021-10141 Local privilege escalation through system temporary directory CVSS 3.1HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences