Java Merge-sort Insecure Temporary File vulnerability

MEDIO 5.5CVE-2022-24913 · GHSA-qxxc-7mq4-mf79 · Published 12/01/2023 · updated 17/06/2026

En resumen

CVE-2022-24913 es una vulnerabilidad MEDIO (CVSS 5.5) que afecta a com.fasterxml.util:java-merge-sort, java-merge-sort (java-merge-sort project).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.25%, mayor que el 16.6% de las vulnerabilidades.
Solución: actualizar a 1.1.0 o posterior.

Package	Affected versions	Patched versions
com.fasterxml.util:java-merge-sort Maven	`< 1.1.0`	`1.1.0`
java-merge-sort java-merge-sort_project	`< 1.1.0`	`1.1.0`

Description

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

NVD description

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

References

nvd.nist.gov/vuln/detail/CVE-2022-24913 · ADVISORY
cowtowncoder/java-merge-sort#21 · WEB
cowtowncoder/java-merge-sort commit 450fdee · WEB
cowtowncoder/java-merge-sort · PACKAGE
security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free