CVE-2021-28168

 

Published at: - 22-04-2021 08:15

Last modified: - 29-07-2022 06:33

Total changes: - 8

Description

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/eclipse-ee4j/jersey/security/advisories/GHSA-c43q-5hpj-4crv
• https://github.com/eclipse-ee4j/jersey/pull/4712
• [kafka-jira] 20210429 [GitHub] [kafka] xjin-Confluent opened a new pull request #10614: MINOR: Upgrade jersey to 2.34-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-jira] 20210505 [jira] [Created] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-dev] 20210505 [jira] [Created] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-jira] 20210505 [GitHub] [kafka] shayelkin opened a new pull request #10636: MINOR: Bump Jersey deps to 2.34 due to CVE-2021-28168-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-jira] 20210506 [jira] [Commented] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-jira] 20210506 [jira] [Assigned] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-jira] 20210506 [GitHub] [kafka] dongjinleekr opened a new pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-commits] 20210506 [kafka] branch 2.7 updated: KAFKA-12752: Bump Jersey deps to 2.34 due to CVE-2021-28168 (#10636)-Exploit, Mailing List, Vendor Advisory
• [kafka-jira] 20210506 [GitHub] [kafka] omkreddy commented on pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-dev] 20210506 [jira] [Resolved] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-commits] 20210506 [kafka] branch 2.8 updated: KAFKA-12752: Bump Jersey deps to 2.34 due to CVE-2021-28168 (#10636)-Exploit, Mailing List, Vendor Advisory
• [kafka-jira] 20210506 [jira] [Resolved] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-jira] 20210506 [GitHub] [kafka] omkreddy merged pull request #10636: MINOR: Bump Jersey deps to 2.34 due to CVE-2021-28168-Mailing List, Vendor Advisory
• [kafka-jira] 20210507 [GitHub] [kafka] dongjinleekr closed pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Mailing List, Vendor Advisory
• [kafka-jira] 20210507 [GitHub] [kafka] dongjinleekr commented on pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02-Issue Tracking, Mailing List, Vendor Advisory
• [kafka-users] 20210617 vulnerabilities-Mailing List, Vendor Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html

 

Keywords

NVD

 

CVE-2021-28168

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures