Description
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Guava | 1.0 – < 32.0 | 32.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | guava-libraries | 32.0.1-1 | — |
| Debian 13 | guava-libraries | 32.0.1-1 | — |
| Debian 12 | guava-libraries | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | guava-libraries | No fix yet | — |
| Ubuntu 20.04 LTS | guava-libraries | No fix yet | — |
| Ubuntu 18.04 LTS | guava-libraries | No fix yet | — |
| Ubuntu 16.04 LTS | guava-libraries | No fix yet | — |
| Ubuntu 14.04 LTS | guava-libraries | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | satellite +1 | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | candlepin | 4.0.9-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | satellite | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-activerecord-session_store | 2.0.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-addressable | 2.8.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.3.2-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-rails +1 | 6.0.3.7-1.el7sat | RHSA-2021:4702 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-9.redhat_00019.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-guava +1 | 30.1.0-1.redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-guava-failureaccess | 1.0.1-1.redhat_00002.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.13-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.27-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.39-1.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.18-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.20-2.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-5.Final_redhat_00006.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.34-1.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.6-1.GA_redhat_00002.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.25-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.6-1.GA_redhat_00002.1.el7eap | RHSA-2021:0873 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.14-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | guava | 32.0.1-150200.3.7.1 | SUSE-SU-2023:3090-1 |
| SLES 15 SP4 | guava | 32.0.1-150200.3.7.1 | SUSE-SU-2023:3090-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Real Time 15 SP3 | guava | 32.0.1-150200.3.7.1 | SUSE-SU-2023:3090-1 |
| SUSE Manager Server Module 4.3 | guava | 32.0.1-150400.3.3.1 | SUSE-SU-2024:1138-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | guava | 30.1.1-1.2 | openSUSE-SU-2024:10835-1 |
| openSUSE Leap 15.5 | guava | 32.0.1-150200.3.7.1 | SUSE-SU-2023:3090-1 |
| openSUSE Leap 15.4 | guava | 32.0.1-150200.3.7.1 | SUSE-SU-2023:3090-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | guava | 25.0-7 | — |
| Azure Linux 2 (CBL-Mariner) | guava20 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cassandra-reaper | 4.0.1-r1 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.3-r7 | — |
| Wolfi rolling | druid | 34.0.0-r6 | — |
| Wolfi rolling | gradle-8 | 8.2.1-r1 | — |
| Wolfi rolling | gradle-stage0 +1 | No fix yet | — |
| Wolfi rolling | maven-stage0 | 3.9.12-r0 | — |
| Wolfi rolling | spdx-tools-java | 1.1.8-r1 | — |
| Wolfi rolling | trino-plugin-clickhouse | 481-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.google.guava:guava | < 32.0.0-android | 32.0.0-android | GHSA-5mg8-w23w-74h3 |
Advisories 17
- RHSA-2021:4702 Red Hat Security Advisory: Satellite 6.10 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0873 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0874 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0872 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- SUSE-SU-2024:1138-1 Security update for guava SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:3090-1 Security update for guava SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10835-1 guava-30.1.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-1272 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025
- WID-SEC-2024-3684 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2024
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2024-1872 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 15, 2024
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-1813 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1664 IBM Integration Bus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 4, 2023
- WID-SEC-2023-1034 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
References
- https://github.com/google/guava/issues/4011
- https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415
- [ws-commits] 20210104 [ws-wss4j] branch master updated: Updating Guava to 30.1 due to CVE-2020-8908 mailing-list
- [ws-commits] 20210104 [ws-wss4j] branch 2_3_x-fixes updated: Updating Guava to 30.1 due to CVE-2020-8908 mailing-list
- [cxf-commits] 20210104 [cxf] 03/04: Updating Guava to 30.1 due to CVE-2020-8908 mailing-list
- [cxf-commits] 20210104 [cxf] 02/02: Updating Guava to 30.1 due to CVE-2020-8908 mailing-list
- https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3%40%3Ctorque-dev.db.apache.org%3E
- [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core mailing-list
- [db-torque-dev] 20210127 Re: Items for our (delayed) quarterly report to the board? mailing-list
- [db-torque-dev] 20210128 Antwort: Re: Items for our (delayed) quarterly report to the board? mailing-list
- [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities mailing-list
- [myfaces-dev] 20210506 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #817: build: CVE fix mailing-list
- [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- [drill-dev] 20210618 [GitHub] [drill] ssainz edited a comment on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 mailing-list
- [drill-dev] 20210618 [GitHub] [drill] ssainz commented on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 mailing-list
- [drill-dev] 20210618 [GitHub] [drill] cgivre commented on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 mailing-list
- [drill-dev] 20210619 [GitHub] [drill] luocooong commented on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- [hadoop-yarn-issues] 20211018 [jira] [Updated] (YARN-10980) fix CVE-2020-8908 mailing-list
- [hadoop-yarn-dev] 20211018 [jira] [Created] (YARN-10980) fix CVE-2020-8908 mailing-list
- [hadoop-common-issues] 20211018 [GitHub] [hadoop] lujiefsi opened a new pull request #3561: Yarn 10980 mailing-list
- [hadoop-yarn-issues] 20211018 [jira] [Created] (YARN-10980) fix CVE-2020-8908 mailing-list
- [hadoop-yarn-dev] 20211018 [jira] [Resolved] (YARN-10980) fix CVE-2020-8908 mailing-list
- [hive-dev] 20211018 [jira] [Created] (HIVE-25617) fix CVE-2020-8908 mailing-list
- [hadoop-common-issues] 20211018 [GitHub] [hadoop] lujiefsi edited a comment on pull request #3561: YARN-10980:fix CVE-2020-8908 mailing-list
- [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) fix CVE-2020-8908 mailing-list
- [hive-issues] 20211018 [jira] [Updated] (HIVE-25617) fix CVE-2020-8908 mailing-list
- [hive-issues] 20211018 [jira] [Work logged] (HIVE-25617) fix CVE-2020-8908 mailing-list
- [hadoop-yarn-issues] 20211018 [jira] [Comment Edited] (YARN-10980) fix CVE-2020-8908 mailing-list
- [hadoop-yarn-issues] 20211018 [jira] [Resolved] (YARN-10980) fix CVE-2020-8908 mailing-list
- [hive-gitbox] 20211018 [GitHub] [hive] lujiefsi opened a new pull request #2725: HIVE-25617:fix CVE-2020-8908 mailing-list
- [hadoop-yarn-issues] 20211018 [jira] [Commented] (YARN-10980) fix CVE-2020-8908 mailing-list
- [geode-issues] 20211018 [jira] [Created] (GEODE-9744) fix CVE-2020-8908 mailing-list
- [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) bug like CVE-2020-8908 mailing-list
- [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) bug CVE-2020-8908 mailing-list
- [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) like CVE-2020-8908 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- [pig-dev] 20211021 [GitHub] [pig] lujiefsi opened a new pull request #36: PIG-5417:Replace guava's Files.createTempDir() mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220210-0003/