[SECURITY] [DLA 2426-1] junit4 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2426-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Abhijith PA
November 01, 2020 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : junit4
Version : 4.12-4+deb9u1
CVE ID : CVE-2020-15250
Debian Bug : 972231
In junit4 the test rule TemporaryFolder contains a local information
disclosure vulnerability. On Unix like systems, the system's temporary
directory is shared between all users on that system. Because of this,
when files and directories are written into this directory they are, by
default, readable by other users on that same system. This vulnerability
does not allow other users to overwrite the contents of these directories
or files. This is purely an information disclosure vulnerability. This
vulnerability impacts you if the JUnit tests write sensitive information,
like API keys or passwords, into the temporary folder, and the JUnit
tests execute in an environment where the OS has other untrusted users.
For Debian 9 stretch, this problem has been fixed in version
4.12-4+deb9u1.
We recommend that you upgrade your junit4 packages.
For the detailed security status of junit4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/junit4
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAl+e7HMACgkQhj1N8u2c
KO970w/8DmMTLdPz8rtUmFEnUZ4Gi8lAjZgvgKPkyCYxSRWpUkbBBEYtXr7DDaXZ
c4ym50U3/XBKIplEN0oxp5sEv7AdO4loHMZu0n8IBjoFiAX+V4rb8U24MNnFET+K
BQGqgVFas0m+e5deHXWpTb4pcWirMSph0NmQIhxucDm5HbGFuveU9RNnt6AuoWWv
hG6y+Qzrhs1cs5hdON8FK0BSnWTKECzziKAbhArvzhotV73ha60/QZ1SC7fYKayG
wrllMDtw4EQwvDLcwuO5Aei5VhZIuTrvkEUkvHfiUArWegevTh9tsOohxKcO21aW
Kz2J0Hin0QjPz/y3NpwbzM405qtx8YsO4qhvVGYjFZwGA3gLdeA1NatdPoSbk9Yi
Wg9V+GxvnCrASx5mAj6uLlp+B87p/r5/tDcKXi9LPoLvf5bznYowDCn6X2MpLGfh
SjQ3esxNImw70ic5x025NSRJTN2bEzip5i1XRjLQVjLLdOuh6x5Ec414H01s5aa+
53vJbuCroqGz+g1qjcEr/ynZWNhsBtC9sqzmbgXEwWkACPdluXlAtKz3e87pb+s+
p5BAOqED6m/2Buh9dDCF7UM/Hr5tuNgKi675UKDeWUiJQpWfjdYhK6PRyqkP5ZDJ
KBiPUF16wudM6W+zrPu/fjdg0NEGLq7VJ8+eNZO9tWjSg/SOgpY=
=eFH1
-----END PGP SIGNATURE-----
Reply to: