GHSA-ppc3-fpvh-7396

Source

https://github.com/advisories/GHSA-ppc3-fpvh-7396

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-ppc3-fpvh-7396/GHSA-ppc3-fpvh-7396.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-ppc3-fpvh-7396

Aliases

CVE-2020-17534

Published

2022-02-09T22:25:18Z

Modified

2023-11-08T04:02:43.124320Z

Severity

7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper synchronization in Apache Netbeans HTML/Java API

Details

There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in webkit subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file.

Database specific

{
    "nvd_published_at": "2021-01-11T16:15:00Z",
    "github_reviewed_at": "2021-04-06T22:32:25Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-362"
    ]
}

References

Affected packages

Maven / org.netbeans.html:pom

Package

Name: org.netbeans.html:pom; View open source insights on deps.dev
Purl: pkg:maven/org.netbeans.html/pom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7.1

Affected versions

0.*

0.7

0.7.1

0.7.5

0.7.6

0.8

0.8.1

0.8.2

0.8.3

0.9

1.*

1.0

1.1

1.2

1.2.1

1.2.2

1.2.3

1.3

1.4

1.5

1.5.1

1.6

1.6.1

1.7