CVE-2020-8908

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-8908
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8908.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-8908
Aliases
Downstream
AZL (2)
CGA (276)
CLEANSTART (21)
CLSA (9)
DEBIAN (1)
ECHO (1)
MGASA (2)
MINI (12)
OESA (1)
openSUSE (1)
RHSA (4)
SUSE (2)
UBUNTU (1)
Related
CGA (1)
openSUSE (1)
SUSE (2)
Published
2020-12-10T23:15:13Z
Modified
2026-07-09T14:43:51Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "fixed":  "20.3"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "oracle:nosql_database"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "17.7"
                },
                {
                    "last_affected":  "17.12"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "oracle:primavera_unifier"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "16.0"
                },
                {
                    "last_affected":  "19.0"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "oracle:retail_customer_management_and_segmentation_foundation"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "11.3.2"
                },
                {
                    "last_affected":  "11.3.2"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:commerce_guided_search"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "1.14.0"
                },
                {
                    "last_affected":  "1.14.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:communications_cloud_native_core_network_repository_function"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "1.2.1"
                },
                {
                    "last_affected":  "1.2.1"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:communications_cloud_native_core_network_slice_selection_function"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "12.0.0.4.0"
                },
                {
                    "last_affected":  "12.0.0.4.0"
                },
                {
                    "introduced":  "12.0.0.5.0"
                },
                {
                    "last_affected":  "12.0.0.5.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:communications_pricing_design_center"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "12.2.1.3.0"
                },
                {
                    "last_affected":  "12.2.1.3.0"
                },
                {
                    "introduced":  "12.2.1.4.0"
                },
                {
                    "last_affected":  "12.2.1.4.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:data_integrator"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.57"
                },
                {
                    "last_affected":  "8.57"
                },
                {
                    "introduced":  "8.58"
                },
                {
                    "last_affected":  "8.58"
                },
                {
                    "introduced":  "8.59"
                },
                {
                    "last_affected":  "8.59"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:peoplesoft_enterprise_peopletools"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "18.8"
                },
                {
                    "last_affected":  "18.8"
                },
                {
                    "introduced":  "19.12"
                },
                {
                    "last_affected":  "19.12"
                },
                {
                    "introduced":  "20.12"
                },
                {
                    "last_affected":  "20.12"
                },
                {
                    "introduced":  "21.12"
                },
                {
                    "last_affected":  "21.12"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:primavera_unifier"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "14.1.1.0.0"
                },
                {
                    "last_affected":  "14.1.1.0.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:weblogic_server"
        }
    ]
}
References

Affected packages

Git / github.com/google/guava

Affected ranges

Type
GIT
Repo
https://github.com/google/guava
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b1f97ced922d48f071153ad9e631d06383033a4
Fixed
fec0dbc4634006a6162cfd4d0d09c962073ddf40
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:google:guava:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "32.0.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

failureaccess-v1.*
failureaccess-v1.0.1
Other
jdk5-backport-branch-point
released-all-futures
v2.*
v2.0
v7.*
v7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8908.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "244004072759715381362783025308972603407",
                "191696127954200063996670176044108409736",
                "178977789205042937699363365843067219663",
                "57691104357535497419766474869340073891"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2020-8908-198203f0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40",
        "target":  {
            "file":  "guava/src/com/google/common/io/Files.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "244004072759715381362783025308972603407",
                "191696127954200063996670176044108409736",
                "178977789205042937699363365843067219663",
                "57691104357535497419766474869340073891"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2020-8908-d54d1950",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40",
        "target":  {
            "file":  "android/guava/src/com/google/common/io/Files.java"
        }
    }
]
vanir_signatures_modified 
"2026-07-09T14:43:51Z"

Git / github.com/quarkusio/quarkus

Affected ranges

Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
60a549cadba9f9e10583b4348b5102e8b4087aa7
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.11.4"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8908.json"