Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Insecure temporary file creation (CWE-377, CWE-378) in dev-environment-core #1653

Closed
7 tasks done
sjinks opened this issue Jan 15, 2024 · 1 comment · Fixed by #1654
Closed
7 tasks done

Insecure temporary file creation (CWE-377, CWE-378) in dev-environment-core #1653

sjinks opened this issue Jan 15, 2024 · 1 comment · Fixed by #1654
Assignees
@sjinks
Labels
[Type] Bug Something isn't working

Comments

@sjinks
Copy link
Member

sjinks commented Jan 15, 2024 •
edited
Loading

Temporary files created in the operating system's temporary directory are by default accessible to other users. In some cases, this can lead to information exposure, or in the worst case, to remote code execution.

This is a tracking issue for:

Ref: CWE-377: Insecure Temporary File
Ref: CWE-378: Creation of Temporary File With Insecure Permissions
@sjinks sjinks added the [Type] Bug Something isn't working label Jan 15, 2024
@sjinks sjinks self-assigned this Jan 15, 2024
@sjinks sjinks mentioned this issue Jan 15, 2024
Merged
7 tasks
@sjinks
Copy link
Member Author

sjinks commented Jan 15, 2024

Fixed in #1654

sjinks added a commit that referenced this issue Jan 18, 2024
@sjinks
Merge pull request #1654 from Automattic/GH-1653
32d66f6 
fix(dev-env): CWE-377, CWE-378 originating from `xdgDataDirectory()`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sjinks sjinks

Labels
[Type] Bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(dev-env): CWE-377, CWE-378 originating from xdgDataDirectory() Automattic/vip-cli
1 participant
@sjinks