CVE-2021-28100: 
Java vulnerability analysis and mitigation

A local information disclosure vulnerability was identified in Netflix's Priam, tracked as CVE-2021-28100. The vulnerability was discovered by security researcher Jonathan Leitschuh and disclosed on March 23, 2021. The issue affects the Priam process, which is a Netflix OSS project, where temporary files are created with world-readable permissions (Netflix Advisory).

The vulnerability stems from Priam's usage of File.createTempFile function, which creates temporary files with -rw-r--r-- permissions. This implementation flaw results in world-readable temporary files that can expose sensitive information written by the Priam process (Netflix Advisory).

The vulnerability allows attackers with read access to the local filesystem to read any content written to the temporary files by the Priam process, potentially exposing sensitive information (Netflix Advisory).

The vulnerability requires local access to the filesystem where Priam is running. An attacker must have read permissions on the system to exploit this vulnerability (Netflix Advisory).

As a workaround, it is recommended to avoid running Priam in configurations that share a filesystem with less-trusted processes. Netflix indicated that a fix may be included in a future release (Netflix Advisory).