Description
Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | com.fasterxml.util:java-merge-sort | < 1.1.0 | 1.1.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.util:java-merge-sort | < 1.1.0 | 1.1.0 | GHSA-qxxc-7mq4-mf79 |