CVE-2020-8908 is a low-severity vulnerability affecting all versions of the Guava library, which is used in various software systems such as Google Guava, Quarkus, Oracle, and NetApp. This vulnerability allows an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API. Although the issue has been addressed in some software, it remains present in others, highlighting the importance of keeping software up-to-date and using secure alternatives when available.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, you should check if your application uses the Files::createTempDir method from Google's Guava library. If it does, and your application runs on a Unix-like operating system where the /temp directory is shared between all users, your application could be vulnerable. Affected versions include all Guava versions up to (excluding) 32.0.0, Quarkus up to (excluding) 1.11.4, and various versions of Oracle and NetApp software.

What should I do if I'm affected?

If you're affected by the vulnerability, you should update your software to a secure version. For Android developers, switch to using context.getCacheDir() for temporary directories. For Java developers, migrate to java.nio.file.Files.createTempDirectory() or set the java.io.tmpdir system property to a secure directory when starting the JVM.

Is CVE-2020-8908 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2020-8908 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue occurs in the Guava library when temporary directories are created with incorrect permissions, potentially allowing unauthorized access to sensitive information. To address this vulnerability, it is recommended to update the software to a secure version or use alternative methods for creating temporary directories that provide better security.

Weakness enumeration

The Weakness Enumeration for CVE-2020-8908 includes two CWEs: CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-378 (Creation of Temporary File With Insecure Permissions). This vulnerability affects temp directory creation in Guava, potentially leading to unauthorized access to sensitive information.

For more details

CVE-2020-8908 is a low-severity vulnerability that highlights the importance of keeping software up-to-date and using secure alternatives. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Google Guava Commit on GitHub

• CVE-2020-8908 Discussion on GitHub

• Apache Hadoop Pull Request Discussion

• Apache Drill Vulnerability Discussion