{"id":"CVE-2021-28099","aliases":[],"url":"https://o3.security/vulnerability/CVE-2021-28099","summary":"Insecure temporary file in Netflix OSS Hollow","details":"> ID: NFLX-2021-001\n> Title: Local information disclosure in Hollow\n> Release Date: 2021-03-23\n> Credit: Security Researcher @JLLeitschuh\n\n# Overview\n\nSecurity researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.\n\n# Impact\n\nAn attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.\n\n# Description\n\nSince the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.\n\n# Workarounds and Fixes\n\nAvoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.","published":"2021-03-29T18:25:26Z","modified":"2024-02-16T08:10:15.734375Z","cvss":{"score":4.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"com.netflix.hollow:hollow","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-j83w-7qr9-wv86"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28099"},{"type":"WEB","url":"https://github.com/Netflix/hollow/issues/502"},{"type":"WEB","url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-001.md"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-02-16T08:10:15.734375Z"}}