CVE-2022-24913: Java Merge-sort Insecure Temporary File vulnerability

January 12, 2023 (updated November 9, 2023)

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 is vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

References

github.com/advisories/GHSA-qxxc-7mq4-mf79
github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902
github.com/cowtowncoder/java-merge-sort/pull/21
nvd.nist.gov/vuln/detail/CVE-2022-24913
security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926

Code Behaviors & Features

Detect and mitigate CVE-2022-24913 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →