Insecure Temporary File Vulnerability in com.fasterxml.util:java-merge-sort by FasterXML

CVE-2022-24913

What is CVE-2022-24913?

The java-merge-sort package by FasterXML is prone to an Insecure Temporary File vulnerability, located in the StdTempFileProvider() function. This issue arises due to the usage of the permissive File.createTempFile() method, which can lead to unintended exposure of the temporary file contents, thereby increasing the risk of unauthorized access to sensitive data. Users of versions prior to 1.1.0 should take immediate actions to mitigate this vulnerability by upgrading their installations.

References