CVE-2022-24913: 
Java vulnerability analysis and mitigation

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java. The vulnerability was discovered and disclosed on January 11, 2023, and was assigned CVE-2022-24913. The vulnerability affects the core functionality of the java-merge-sort package, which is used for basic configurable disk-backed N-way merge sort operations (Snyk Advisory).

The vulnerability stems from the use of the permissive File.createTempFile() function in StdTempFileProvider.java, which creates temporary files with default permissions of -rw-r--r--. This implementation allows any other user on the system to read the contents of the temporary files. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium severity) with a vector string of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Snyk Advisory, GitHub PR).

The vulnerability allows information disclosure where temporary file contents are exposed to other local users on the system. On unix-like systems where the system temporary directory is shared between all users (except MacOS and Windows), this could lead to unauthorized access to potentially sensitive information stored in these temporary files (GitHub PR).

The vulnerability requires local access to the system where the vulnerable code is running. An attacker would need to be co-resident on the same machine to view the contents of the temporary files created by the application. The exploit complexity is considered low, as no special conditions are required for exploitation (Snyk Advisory).

The vulnerability has been fixed in version 1.1.0 of com.fasterxml.util:java-merge-sort. The fix involves replacing File.createTempFile() with Files.createTempFile(), which creates files with more secure permissions (-rw-------) that only allow the file owner to read or write the contents. Users should upgrade to version 1.1.0 or higher to address this vulnerability (GitHub Commit).

The vulnerability was responsibly disclosed and handled through collaboration between security researcher Jonathan Leitschuh and the project maintainers. The fix was implemented promptly and released as part of version 1.1.0, with the project maintainers increasing the JDK baseline requirement as part of the security update (GitHub PR).