Skip to content
OpenAdvisories
Medium CVE-2013-2035 EUVD-2022-2345GHSA-49j7-qghp-5wj8

Improper Control of Generation of Code in HawtJNI

Published Aug 28, 2013 · Updated Aug 6, 2024 · Assigned by redhat

Package: hawtjni Package: hawtjni Package: org.fusesource.hawtjni:hawtjni-runtime Package: thingsboard-tb-node Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 hawtjni 1.10-1 —
Debian 13 hawtjni 1.10-1 —
Debian 12 hawtjni 1.10-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS hawtjni 1.0~+git0c502e20c4-3+deb7u1build0.14.04.1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 2 activemq +1 5.9.0-4.redhat.610328.el6op RHSA-2014:0245
Red Hat OpenShift 1 activemq +1 5.9.0-4.redhat.610328.el6op RHSA-2014:0254
Red Hat JBoss EAP 6 antlr-eap6 2.7.7-17.redhat_4.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 apache-commons-beanutils 1.8.3-13.redhat_6.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 apache-commons-cli 1.2-8.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 apache-commons-configuration 1.6-8.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 apache-commons-daemon-eap6 1:1.0.15-5.redhat_1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 apache-commons-pool-eap6 1.6-7.redhat_6.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 apache-cxf 2.7.7-1.redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 apache-mime4j 0.6-8.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 atinject-eap6 1-5.redhat_4.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 dom4j-eap6 1.6.1-20.redhat_6.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 glassfish-jaxb-eap6 2.2.5-17.redhat_7.2.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 glassfish-jsf-eap6 2.1.19-2.3.redhat_2.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 glassfish-jsf12-eap6 1.2_15-5.b01_redhat_8.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 gnu-getopt 1.0.13-3.redhat_4.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 hibernate4-eap6 +4 4.2.7-3.3.SP1_redhat_3.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 hornetq 2.3.12-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 hornetq-native +1 2.3.8-1.Final_redhat_1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 httpserver 1.0.1-4.Final_redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 infinispan +4 5.2.7-2.Final_redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 ironjacamar-eap6 +9 1.0.23-1.3.Final_redhat_1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jacorb-jboss 2.3.2-12.redhat_5.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jansi 1.9-5.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 javassist-eap6 3.18.1-1.GA_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jaxen 1.1.3-9.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbosgi-metadata 2.2.0-2.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-aesh 0.33.8-1.redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-as-cli 7.3.0-5.Final_redhat_14.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-as-ee +49 7.3.0-6.Final_redhat_14.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-dmr 1.2.0-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-ejb-client 1.0.24-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-ejb3-ext-api 2.1.0-1.redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-genericjms 1.0.1-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-hal +1 2.0.6-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-jacc-api_1.4_spec 1.0.3-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-logmanager 1.5.1-1.Final_redhat_1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-marshalling 1.4.2-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-modules 1.3.0-2.Final_redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-remoting3 3.2.18-1.GA_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-remoting3-jmx 1.1.2-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-security-negotiation 2.2.6-2.Final_redhat_1.2.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-security-xacml 2.0.8-10.Final_redhat_5.2.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-threads 2.1.1-1.Final_redhat_1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-vfs2 3.2.2-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jboss-weld-1.1-api 1.1-8.Final_redhat_4.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossas-appclient 7.3.0-8.Final_redhat_14.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossas-core +6 7.3.0-7.Final_redhat_14.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossas-domain 7.3.0-22.Final_redhat_14.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossas-javadocs 7.3.0-14.Final_redhat_14.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossas-modules-eap 7.3.0-21.Final_redhat_14.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossts 1:4.17.15-4.Final_redhat_4.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossws-api 1.0.2-1.Final_redhat_1.2.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossws-common 2.2.3-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossws-common-tools 1.2.0-2.Final_redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossws-cxf 4.2.3-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossws-native 4.1.2-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jbossws-spi 2.2.2-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jcip-annotations-eap6 1.0-5.redhat_6.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jdom-eap6 1.1.2-5.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jettison 1.3.1-8.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 jgroups 1:3.2.12-1.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 juddi 3.1.3-4.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 mod_cluster +1 1.2.6-2.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 mod_cluster-native 1.2.6-1.Final.redhat_1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 mod_jk +1 1.2.37-4.redhat_3.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 objectweb-asm-eap6 3.3.1-6.3.redhat_5.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 opensaml 2.5.3-3.redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 openws 1.4.4-2.redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 org.apache.felix.configadmin 1.2.8-7.redhat_4.2.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 org.apache.felix.log 1.0.0-6.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 org.osgi-eap6 +2 4.2.0-11.10.redhat_4.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 picketbox 4.0.19-1.SP2_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 picketlink-federation 2.1.9-3.SP2_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 resteasy 2.3.7-2.Final_redhat_2.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 scannotation 1.0.3-2.redhat_4.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 shrinkwrap +4 1.1.2-3.redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 slf4j +1 1.7.2-11.redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 stilts 0.1.26-10.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 sun-ws-metadata-2.0-api 1.0.MR1-16_MR1_redhat_6.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 velocity-eap6 1.7-4.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 weld-cdi-1.0-api 1.0-9.SP4.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 weld-core 1.1.16-3.Final_redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 ws-commons-XmlSchema 2.0.2-8.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 ws-commons-neethi 3.0.2-6.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 ws-scout 1.2.6-4.redhat_3.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 wsdl4j-eap6 1.6.2-14.redhat_6.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 wss4j 1.6.12-1.redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 xerces-j2-eap6 2.9.1-16.redhat_5.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 xjc-utils +4 2.6.1-4.redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 xml-commons-resolver-eap6 1.2-16.redhat_9.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 xml-security 1.5.5-2.redhat_2.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 xmltooling 1.3.4-3.redhat_1.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785
Red Hat JBoss EAP 6 xom 1.2.7-2.redhat_4.1.ep6.el5 RHSA-2013:1786, RHSA-2013:1785

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling thingsboard-tb-node 4.4-r5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.fusesource.hawtjni:hawtjni-runtime < 1.8 1.8 GHSA-49j7-qghp-5wj8

Advisories 4

References