https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 13:55:00 +0000 https://cve.radiocsirt.org/vuln/cve-2021-21290 <p><strong>Affected:</strong> netty</p> <p>Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &amp; clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method &#34;File.createTempFile&#34; on unix-like systems creates a random file, but, by default will create this file with the permissions &#34;-rw-r--r--&#34;. Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty&#39;s &#34;AbstractDiskHttpData&#34; is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own &#34;java.io.tmpdir&#34; when you start the JVM or use &#34;DefaultHttpDataFactory.setBaseDir(...)&#34; to set the directory to something that is only readable by the current user.</p> <p><strong>Affected:</strong> netty</p> <p>Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &amp; clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method &#34;File.createTempFile&#34; on unix-like systems creates a random file, but, by default will create this file with the permissions &#34;-rw-r--r--&#34;. Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty&#39;s &#34;AbstractDiskHttpData&#34; is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own &#34;java.io.tmpdir&#34; when you start the JVM or use &#34;DefaultHttpDataFactory.setBaseDir(...)&#34; to set the directory to something that is only readable by the current user.</p> https://cve.radiocsirt.org/vuln/cve-2021-21290