Creation of Temporary File With Insecure Permissions in Netty - CVE-2022-24823

Vulnerability identifier: #VU62849

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24823

CWE-ID: CWE-378

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to usage of insecure permissions for temporary files. A local user can view contents of temporary files and gain access to sensitive information.

Netty
IBM Observability with Instana
Log Analysis
Oracle Banking Party Management
Oracle Banking Enterprise Default Management
IBM Watson Knowledge Catalog in Cloud Pak for Data
Oracle Communications Design Studio
Oracle Financial Services Model Management and Governance
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
Oracle Communications Cloud Native Core Binding Support Function
Autodesk Infraworks
IBM Operations Analytics Predictive Insights
Netcool Operations Insight
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Asset Management
eap7-jboss-jsf (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-jberet (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-netty-tcnative (Red Hat package)
eap7-wildfly-openssl (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
libnetty-java (Ubuntu package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
eap7 (Red Hat package)
netty-tcnative-javadoc
netty-tcnative
eap7-glassfish-jsf (Red Hat package)
eap7-jandex (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-picketlink-bindings (Red Hat package)
eap7-gson (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-javapackages-tools (Red Hat package)
netty
netty-help
netty-poms
netty-javadoc
eap7-picketbox (Red Hat package)
Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1
Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1
Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1
Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1
Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1
Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1
Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1
Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1
Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1
Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1
Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1
Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1
Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1
Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
IBM Watson Machine Learning Accelerator
Security QRadar EDR
DataStage on Cloud Pak for Data
Cloud Pak for Network Automation
PowerStore T
IBM Cloud Pak for Watson AIOps
IBM Sterling Order Management
Dell Data Protection Central
Oracle Utilities Testing Accelerator
Oracle Financial Services Crime and Compliance Management Studio
JBoss Enterprise Application Platform
AMQ Broker
Fuse
Oracle Coherence
AMQ Streams
JBoss Data Grid
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
PeopleSoft Enterprise PeopleTools
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Voice Gateway
IBM Disconnected Log Collector
IBM Tivoli Network Manager (ITNM)
watsonx.data
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Security Verify Access

Install updates from vendor's website.

Netty - update to 4.1.78
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-5.SP06_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-5.SP06_redhat_00001.1.el8eap
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.12-1.SP1_redhat_00001.1.el7eap, 1.1.12-1.SP1_redhat_00001.1.el8eap
Log Analysis - update to 1.3.8
eap7-jberet (Red Hat package) - addressed in versions 1.3.9-2.SP2_redhat_00001.1.el7eap, 1.3.9-2.SP2_redhat_00001.1.el8eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.3-2.SP1_redhat_00001.1.el7eap, 1.5.3-2.SP1_redhat_00001.1.el8eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-18.Final_redhat_00017.1.el7eap, 1.10.0-18.Final_redhat_00017.1.el8eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.13-1.Final_redhat_00001.1.el7eap, 1.15.13-1.Final_redhat_00001.1.el8eap
eap7-netty-tcnative (Red Hat package) - addressed in versions 2.0.52-1.Final_redhat_00001.1.el7eap, 2.0.52-1.Final_redhat_00001.1.el8eap
eap7-wildfly-openssl (Red Hat package) - addressed in versions 2.2.3-1.Final_redhat_00001.1.el7eap, 2.2.3-1.Final_redhat_00001.1.el8eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.18-2.SP2_redhat_00001.1.el7eap, 2.2.18-2.SP2_redhat_00001.1.el8eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.12.6.1-2.redhat_00004.1.el7eap, 2.12.6.1-2.redhat_00004.1.el8eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.13-1.Final_redhat_00001.1.el7eap, 3.3.13-1.Final_redhat_00001.1.el8eap
Security QRadar EDR - update to 3.12.15
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.77-1.Final_redhat_00001.1.el7eap, 4.1.77-1.Final_redhat_00001.1.el8eap
eap7-netty (Red Hat package) - addressed in versions 4.1.77-1.Final_redhat_00001.1.el7eap, 4.1.77-1.Final_redhat_00001.1.el8eap
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
DataStage on Cloud Pak for Data - update to 4.8.5
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.25-1.SP1_redhat_00001.1.el7eap, 5.0.25-1.SP1_redhat_00001.1.el8eap
eap7-hibernate (Red Hat package) - addressed in versions 5.3.27-1.Final_redhat_00001.1.el7eap, 5.3.27-1.Final_redhat_00001.1.el8eap
JBoss Enterprise Application Platform - update to 7.4.6
eap7-wildfly (Red Hat package) - addressed in versions 7.4.6-5.GA_redhat_00002.1.el7eap, 7.4.6-5.GA_redhat_00002.1.el8eap
AMQ Broker - update to 7.10.1
Fuse - update to 7.11.1
JBoss Data Grid - update to 8.4.0
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library - update to 34.0
Oracle Communications Pricing Design Center - update to 12.0.0.7.0
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
libnetty-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1:4.1.48-10ubuntu0.1
eap7-wildfly-openssl-el7 (Red Hat package) - update to x86_64-2.2.2-1.Final_redhat_00002.1.el7eap
eap7-wildfly-openssl-el8 (Red Hat package) - update to x86_64-2.2.2-1.Final_redhat_00002.1.el8eap
Voice Gateway - update to 1.0.8.3
IBM Operations Analytics Predictive Insights - update to 1.3.6.6
Netcool Operations Insight - update to 1.6.9
IBM Disconnected Log Collector - update to 1.8.3
Cloud Pak for Security (CP4S) - addressed in versions 1.10.10.0, 1.10.12.0
eap7 (Red Hat package) - update to 1-18.el9eap
watsonx.data - update to 2.0.3
netty-tcnative-javadoc - update to 2.0.59-150200.3.10.1
netty-tcnative - update to 2.0.59-150200.3.10.1
AMQ Streams - addressed in versions 2.2.0, 2.4.0, 2.5.0
eap7-glassfish-jsf (Red Hat package) - addressed in versions 2.3.14-4.SP05_redhat_00001.1.el7eap, 2.3.14-4.SP05_redhat_00001.1.el8eap
eap7-jandex (Red Hat package) - addressed in versions 2.4.2-1.Final_redhat_00001.1.el7eap, 2.4.2-1.Final_redhat_00001.1.el8eap
Cloud Pak for Network Automation - update to 2.4.5
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-21.SP12_redhat_00011.1.el7eap, 2.5.5-21.SP12_redhat_00011.1.el8eap
eap7-picketlink-bindings (Red Hat package) - addressed in versions 2.5.5-26.SP12_redhat_00014.1.el7eap, 2.5.5-26.SP12_redhat_00014.1.el8eap
eap7-gson (Red Hat package) - addressed in versions 2.8.9-1.redhat_00001.1.el7eap, 2.8.9-1.redhat_00001.1.el8eap
IBM Cloud Transformation Advisor - update to 3.3.1
eap7-apache-cxf (Red Hat package) - addressed in versions 3.3.13-1.redhat_00001.1.el7eap, 3.3.13-1.redhat_00001.1.el8eap
eap7-javapackages-tools (Red Hat package) - update to 3.4.1-5.15.6.el9eap
PowerStore T - update to 3.5.0.1-2083289
IBM Cloud Pak for Watson AIOps - update to 4.1
netty - addressed in versions 4.1.13-20, 4.1.13-23
netty-help - addressed in versions 4.1.13-20, 4.1.13-23
netty-poms - update to 4.1.90-150200.4.14.1
netty-javadoc - update to 4.1.90-150200.4.14.1
netty - update to 4.1.90-150200.4.14.1
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
EMC ViPR SRM - update to 4.9.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
eap7-picketbox (Red Hat package) - addressed in versions 5.0.3-10.Final_redhat_00009.1.el7eap, 5.0.3-10.Final_redhat_00009.1.el8eap
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
IBM Maximo Asset Management - update to 7.6.1.2.36
IBM Sterling Order Management - update to 10.0.0.29
IBM Security Verify Access - update to 10.0.7.0
Dell Data Protection Central - update to 19.9
Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1 - update to 76-Final.html
Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1 - update to 77-Final.html
Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1 - update to 78-Final.html
Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1 - update to 79-Final.html
Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1 - update to 80-Final.html
Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1 - update to 81-Final.html
Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1 - update to 82-Final.html
Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1 - update to 84-Final.html
Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1 - update to 85-Final.html
Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1 - update to 86-Final.html
Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1 - update to 87-Final.html
Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1 - update to 88-Final.html
Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1 - update to 89-Final.html
Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1 - update to 90-Final.html

• https://github.com/netty/netty/commit/185f8b2756a36aaa4f973f1a2a025e7d981823f1
• https://github.com/netty/netty/security/advisories/GHSA-269q-hmxg-m83q

• Information disclosure in Netty
• Information disclosure in IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Red Hat AMQ Broker 7.10
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Communications Design Studio
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Creation of Temporary File With Insecure Permissions in Oracle Coherence
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in Red Hat Fuse
• IBM Operations Analytics Predictive Insights update for Netty
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Tivoli Network Manager
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Banking Enterprise Default Management
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Autodesk InfraWorks
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in Red Hat AMQ Streams 2.4
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Dell PowerStore Family
• Creation of temporary file with insecure permissions in IBM Maximo Asset Management
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• IBM Log Analysis update for Apache Solr and Apache Zookeeper
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Security Verify Access
• IBM watsonx.data update for Netty
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Security QRadar EDR
• Ubuntu update for netty
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• openEuler 22.03 LTS SP4 update for netty
• openEuler 22.03 LTS SP3 update for netty
• openEuler 20.03 LTS SP4 update for netty
• openEuler 24.03 LTS SP2 update for netty
• openEuler 24.03 LTS SP1 update for netty
• openEuler 24.03 LTS update for netty