CVE-2023-0481: 
Java vulnerability analysis and mitigation

In RestEasy Reactive implementation of Quarkus, a security vulnerability was identified where the insecure File.createTempFile() method is used in the FileBodyHandler class. This vulnerability (CVE-2023-0481) was discovered in January 2023 and affects the Quarkus framework's RestEasy Reactive component (NVD, Red Hat CVE).

The vulnerability stems from the usage of insecure File.createTempFile() in the FileBodyHandler class of RestEasy Reactive implementation. The issue creates temporary files with insufficient permissions that could potentially be accessed by unauthorized local users. The vulnerability was addressed by implementing a newer API for creating temporary files (GitHub PR).

The vulnerability allows temporary files created by the application to be read by any local user on the system due to insecure file permissions. This could potentially lead to information disclosure if sensitive data is stored in these temporary files (Red Hat CVE).

The vulnerability was fixed in Quarkus version 2.16.1.Final by implementing a newer API for creating temporary files with proper security permissions. Users are advised to upgrade to this version or later to address the security issue (Red Hat Advisory).