CVE-2022-24913

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-24913

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24913.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-24913

Aliases

GHSA-qxxc-7mq4-mf79

Published

2023-01-12T05:15:11.477Z

Modified

2026-04-11T22:01:32.487818Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

References

Affected packages

Git / github.com/cowtowncoder/java-merge-sort

Affected ranges

Type

GIT

Repo

https://github.com/cowtowncoder/java-merge-sort

Events

Introduced

Fixed

4969aadcda1f22bf6f970a465ea5e203f36c4e74

Fixed

450fdee70b5f181c2afc5d817f293efa1a543902

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.0"
        }
    ]
}

Affected versions

0.*

0.8.1b

1.*

1.0.1b

java-merge-sort-0.*

java-merge-sort-0.5.0

java-merge-sort-0.5.1

java-merge-sort-0.5.2

java-merge-sort-0.5.3

java-merge-sort-0.6.0

java-merge-sort-0.7.0

java-merge-sort-0.7.1

java-merge-sort-0.7.2

java-merge-sort-0.8.0

java-merge-sort-0.8.1

java-merge-sort-0.9.0

java-merge-sort-0.9.1

java-merge-sort-1.*

java-merge-sort-1.0.0

java-merge-sort-1.0.1

java-merge-sort-1.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24913.json"

vanir_signatures_modified

"2026-04-11T22:01:32Z"

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14677320851492384218221259449265214697",
                "136242639063738787493988346133491562375",
                "134291028032378787931777221754141333869",
                "329401078967520709774943948019203546797",
                "80487557871319226811111347270159715406",
                "155676590831888048165009876602608533292"
            ]
        },
        "source": "https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902",
        "id": "CVE-2022-24913-1a053058",
        "signature_type": "Line",
        "target": {
            "file": "src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 128.0,
            "function_hash": "99739631472293076589966071746306765604"
        },
        "source": "https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902",
        "id": "CVE-2022-24913-c7157514",
        "signature_type": "Function",
        "target": {
            "function": "provide",
            "file": "src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java"
        }
    }
]