CVE-2022-21126
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-21126
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21126.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-21126
- Aliases
- Downstream
- Published
- 2022-11-29T17:15:11Z
- Modified
- 2025-10-15T02:25:29.845899Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.
- References
Affected packages
Git / github.com/samtools/htsjdk
Affected ranges
- Type
- GIT
- Repo
- https://github.com/samtools/htsjdk
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
1.*
1.113
1.114
1.115
1.116
1.117
1.118
1.119
1.120
1.121
1.122
1.123
1.124
1.125
1.126
1.127
1.128
1.129
1.130
1.131
1.133
1.134
1.135
1.136
1.137
1.138
1.139
1.140
1.141
1.142
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.15.0
2.16.0
2.16.1
2.17.0
2.18.0
2.18.1
2.18.2
2.19.0
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.20.0
2.20.1
2.20.2
2.20.3
2.21.0
2.21.1
2.21.2
2.22.0
2.23.0
2.24.0
2.24.1
2.3.0
2.3.0_buildhotfix
2.4.0
2.4.1
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1
2.9.0
2.9.1
3.*
3.0.0
Database specific
{
"vanir_signatures": [
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/variant/vcf/VCFMergerTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"190243121404175968556898503944779845338",
"172682995083196134213455740128378881106",
"202027173843825547381830007852381107615",
"149266121814263730027278577536837126360"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-099dc90a",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/util/IOUtilTest.java",
"function": "createLocalFiles"
},
"signature_version": "v1",
"digest": {
"length": 351.0,
"function_hash": "322865586794886201324158307633405525302"
},
"id": "CVE-2022-21126-09d0c151",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/tribble/index/IndexFactoryTest.java",
"function": "testIndexRedirectedFiles"
},
"signature_version": "v1",
"digest": {
"length": 1193.0,
"function_hash": "132626813690223609058003109484158721477"
},
"id": "CVE-2022-21126-1fcb84a5",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/samtools/reference/FastaSequenceIndexCreatorTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299626316927264171527189963257735733747",
"140929930312599594847798749687032822401",
"282774608707733993190787251205050794189",
"50859710151712684947578712585418342290"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-49c9acda",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/tribble/index/IndexFactoryTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"59054967066091980695805507356768458069",
"23664166286020052899008013465400664660",
"46781572012365655188268042600358030162",
"135400310458581339538496685556101001590",
"18935595498945060999484832616104585515",
"295559975065451951321613894035935937965",
"328673297245674257761634365993468221552",
"177975870659807443538220484376063525661",
"39167473591000412086056270779847957013",
"165596493405660916573356732078303146159",
"22828417594200161773453882249579069991",
"177614450840812099709030943009771076029"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-587b9632",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/seekablestream/SeekableStreamFactoryTest.java",
"function": "testPathWithEmbeddedSpace"
},
"signature_version": "v1",
"digest": {
"length": 787.0,
"function_hash": "73119092046264786313145414990239248125"
},
"id": "CVE-2022-21126-58bdb2eb",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/tribble/index/IndexFactoryTest.java",
"function": "testCreateLinearIndexFromBCF"
},
"signature_version": "v1",
"digest": {
"length": 1140.0,
"function_hash": "193990000650194456778230667506738864190"
},
"id": "CVE-2022-21126-63425c61",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/main/java/htsjdk/samtools/util/IOUtil.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"155458141461161964664830851354333836709",
"240392839938811889894383207537335066175",
"105785770956838740555634856336057300291",
"266914357684368404251471375735806471428",
"15344680243215791623537081327946177646",
"174591450596525566073066074921436085183",
"6044141299928353841960568106678223558",
"228842704925952140726551128482575269844",
"130770586674084897296761473485097695770",
"309417174571416661408291527116465441302",
"210418413377788252536616418103063275629",
"93037749533167087278639541909209642826",
"127511581347928495024497355893544668067",
"92283995314913313305964916259485817766"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-6da9610f",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/tribble/index/IndexFactoryTest.java",
"function": "testCreateTabixIndexFromVCF"
},
"signature_version": "v1",
"digest": {
"length": 1126.0,
"function_hash": "148886692087390927093735168733013802402"
},
"id": "CVE-2022-21126-7664a4c2",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/reference/FastaSequenceIndexCreatorTest.java",
"function": "testCreate"
},
"signature_version": "v1",
"digest": {
"length": 955.0,
"function_hash": "326085283453265714613958093407815634087"
},
"id": "CVE-2022-21126-7c700b0a",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/util/IOUtilTest.java",
"function": "testDeletePathLocal"
},
"signature_version": "v1",
"digest": {
"length": 185.0,
"function_hash": "286678755859940100081651349132354931365"
},
"id": "CVE-2022-21126-7ed52c92",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/variant/vcf/VCFFileReaderTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"300122774035676590908716369429585355294",
"32943598868949688949262475530457027171",
"242270260103788918727575121908543719540",
"282057902519568445356507246879244917388"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-86ae4b6e",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/main/java/htsjdk/samtools/CoordinateSortedPairInfoMap.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"100595333098813338808881522542262448297",
"202039609062385759556120696770518486677",
"337961014036050031175687382614369976887",
"211819650441313234750705955760350681385"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-8768789e",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/CRAMFileWriterTest.java",
"function": "test_roundtrip_many_reads"
},
"signature_version": "v1",
"digest": {
"length": 1576.0,
"function_hash": "9466626151364229112355690081235862103"
},
"id": "CVE-2022-21126-8eb37215",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/tribble/index/IndexTest.java",
"function": "testWriteBasedOnNonRegularFeatureFile"
},
"signature_version": "v1",
"digest": {
"length": 311.0,
"function_hash": "160759159307752445351663967120826486546"
},
"id": "CVE-2022-21126-9092a010",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/variant/vcf/VCFFileReaderTest.java",
"function": "testTabixFileWithEmbeddedSpaces"
},
"signature_version": "v1",
"digest": {
"length": 688.0,
"function_hash": "121274500283061263655343136236371116216"
},
"id": "CVE-2022-21126-a343a6d7",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/tribble/index/tabix/TabixIndexTest.java",
"function": "testBedTabixIndex"
},
"signature_version": "v1",
"digest": {
"length": 1382.0,
"function_hash": "266103464446038836822721629545148428727"
},
"id": "CVE-2022-21126-a3b3a5cb",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/tribble/index/IndexTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"114372671299854683008513371121488718694",
"2672304339857698527797464118662795256",
"272884606852874486810440344549148339619",
"154439530604665965526382495716510345400"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-a88611a8",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/CRAMMergerTest.java",
"function": "test"
},
"signature_version": "v1",
"digest": {
"length": 1175.0,
"function_hash": "149160951659493889560684466069218210261"
},
"id": "CVE-2022-21126-a8cfcfcc",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/tribble/index/tabix/TabixIndexTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"280403769182634337561239323752942460380",
"264545062983323365025073332406696475336",
"245100807922922837448171021738114361606",
"279811992101261578290737748033193276503"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-aaa8767b",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/util/IOUtilTest.java",
"function": "testDeleteArrayPathLocal"
},
"signature_version": "v1",
"digest": {
"length": 185.0,
"function_hash": "286678755859940100081651349132354931365"
},
"id": "CVE-2022-21126-bb629a8b",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/samtools/BAMMergerTest.java",
"function": "test"
},
"signature_version": "v1",
"digest": {
"length": 1564.0,
"function_hash": "146509699132295885102358894247455907399"
},
"id": "CVE-2022-21126-bfab3ffe",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/main/java/htsjdk/samtools/util/IOUtil.java",
"function": "createTempDir"
},
"signature_version": "v1",
"digest": {
"length": 436.0,
"function_hash": "294036242196590297259219949272945188853"
},
"id": "CVE-2022-21126-c0bae84d",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/samtools/BAMMergerTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"190243121404175968556898503944779845338",
"172682995083196134213455740128378881106",
"12023482309185834494286041149571868825",
"202918850739020559284473976957690329970"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-c5f12e80",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/samtools/seekablestream/SeekableStreamFactoryTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"61791876032813049354230572162999374631",
"253565403215050999439964306632740680227",
"220956288238792380308541465219447540855",
"179533867407900361184049820616023785505"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-d7f73a18",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "src/test/java/htsjdk/variant/vcf/VCFMergerTest.java",
"function": "test"
},
"signature_version": "v1",
"digest": {
"length": 1014.0,
"function_hash": "28145086513290227736704000415858426624"
},
"id": "CVE-2022-21126-dfdb6127",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/samtools/CRAMMergerTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"190243121404175968556898503944779845338",
"172682995083196134213455740128378881106",
"293235393138786139002660199572186991249",
"151849234040404759313695997166942287696"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-e5136afe",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/samtools/util/IOUtilTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"219303093302610931000840205624420441734",
"156624168678841347760494889835145344694",
"105696749786711942067758415275282464393",
"38099631442077724695177261244134291289",
"29907395222244795724879480362708334585",
"122826902429240120194415728383411189581",
"95180639451347538205729967339151699721",
"113176498560488144804179735443235014761",
"292399557583414159193010501212873486313",
"59216962601648208813585834575980852124",
"284886911664172518140396777386806721986",
"336123041948377893916680852001375948588",
"91107236410292847939168368337542199903",
"176273004629473307055238271847515203639",
"67706947848449502591657550251377191637",
"87488975336697898126144582452987717160",
"22207339306869595383236230966227740929"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-eb5ca53c",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/test/java/htsjdk/samtools/CRAMFileWriterTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"30194100635754640455313632008922236747",
"93852679511774579881014438548474803720",
"303045893536239506386568679119582466229",
"302001699534537354798979176157499974991",
"93324487414781355924565174988624757285",
"108884137218457734529515960734326863063",
"16227464792642814416749199333903477116",
"190674427287627694301273133448945678620"
],
"threshold": 0.9
},
"id": "CVE-2022-21126-f48a8607",
"source": "https://github.com/samtools/htsjdk/commit/4a4024a97ee3e87096df6ad9b22c8260bd527772"
}
]
}