libnetty-java: Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable...

Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable high performance protocolservers & clients. In Netty before version 4.1.59.Final there is avulnerability on Unix-like systems involving an insecure temp file. Whennetty's multipart decoders are used local information disclosure can occurvia the local system temporary directory if temporary storing uploads onthe disk is enabled. On unix-like systems, the temporary directory isshared between all user. As such, writing to this directory using APIs thatdo not explicitly set the file/directory permissions can lead toinformation disclosure. Of note, this does not impact modern MacOSOperating Systems. The method "File.createTempFile" on unix-like systemscreates a random file, but, by default will create this file with thepermissions "-rw-r--r--". Thus, if sensitive information is written to thisfile, other local users can read this information. This is the case innetty's "AbstractDiskHttpData" is vulnerable. This has been fixed inversion 4.1.59.Final. As a workaround, one may specify your own"java.io.tmpdir" when you start the JVM or use"DefaultHttpDataFactory.setBaseDir(...)" to set the directory to somethingthat is only readable by the current user.

Where it's fixed