CVE-2020-8908: 
Java vulnerability analysis and mitigation

A temp directory creation vulnerability exists in all versions of Guava prior to version 30.0, identified as CVE-2020-8908. The vulnerability is related to the Guava API com.google.common.io.Files.createTempDir(), which creates temporary directories with world-readable permissions on unix-like systems, potentially allowing attackers with local system access to read data stored in these directories. The vulnerability was discovered in October 2020 (Snyk).

The vulnerability stems from the createTempDir() method in Guava's Files class, which creates temporary directories with default permissions that are world-readable (readable by all users) on unix-like systems. The CVSS v3.1 base score is 3.3 (LOW) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The impact of this vulnerability is that any attacker with local access to the machine can potentially access sensitive data stored in temporary directories created by the vulnerable Guava API. This is particularly concerning because the /tmp directory is shared between all users on unix-like systems, making any world-readable files accessible to other users on the system (GitHub Issue).

The vulnerability requires local access to the target system to exploit. An attacker must have the ability to run code on the same machine where the vulnerable Guava code is being used. The vulnerability has been confirmed to be exploitable through proof-of-concept code that demonstrates the ability to read contents of the temporary directories (Snyk).

For Android developers, it is recommended to use Android's built-in temporary directory API, such as context.getCacheDir(). For Java developers running Java 7 or later, the recommendation is to migrate to java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700. Alternatively, users can configure the Java runtime's java.io.tmpdir system property to point to a location with appropriately configured permissions. The vulnerable method has been deprecated in Guava versions 30.0 and later (GitHub Commit).

The vulnerability was initially reported and discussed on GitHub, where Google's response was to deprecate the method and document the behavior rather than fixing it directly, as better alternatives exist in modern Java versions. This approach was generally accepted by the security community given the availability of safer alternatives (GitHub Issue).