In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - junit4: TemporaryFolder is shared between all users across system which could result in information     disclosure (CVE-2020-15250)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the junit package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In JUnit4 from version 4.7 and before 4.13.1, the test     rule TemporaryFolder contains a local information     disclosure vulnerability. On Unix like systems, the     system's temporary directory is shared between all     users on that system. Because of this, when files and     directories are written into this directory they are,     by default, readable by other users on that same     system. This vulnerability does not allow other users     to overwrite the contents of these directories or     files. This is purely an information disclosure     vulnerability. This vulnerability impacts you if the     JUnit tests write sensitive information, like API keys     or passwords, into the temporary folder, and the JUnit     tests execute in an environment where the OS has other     untrusted users. Because certain JDK file system APIs     were only added in JDK 1.7, this this fix is dependent     upon the version of the JDK you are using. For Java 1.7     and higher users: this vulnerability is fixed in     4.13.1. For Java 1.6 and lower users: no patch is     available, you must use the workaround below. If you     are unable to patch, or are stuck running on Java 1.6,     specifying the `java.io.tmpdir` system environment     variable to a directory that is exclusively owned by     the executing user will fix this vulnerability. For     more information, including an example of vulnerable     code, see the referenced GitHub Security     Advisory.(CVE-2020-15250)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4731-1 advisory.

    It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could     possibly use this issue to obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In junit4 the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users.

For Debian 9 stretch, this problem has been fixed in version 4.12-4+deb9u1.

We recommend that you upgrade your junit4 packages.

For the detailed security status of junit4 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/junit4

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199209	RHEL 8 : junit (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196488	RHEL 7 : junit4 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
153320	EulerOS 2.0 SP2 : junit (EulerOS-SA-2021-2391)	Nessus	Huawei Local Security Checks	medium
149617	EulerOS 2.0 SP5 : junit (EulerOS-SA-2021-1903)	Nessus	Huawei Local Security Checks	medium
149543	EulerOS 2.0 SP8 : junit (EulerOS-SA-2021-1878)	Nessus	Huawei Local Security Checks	medium
149131	EulerOS 2.0 SP3 : junit (EulerOS-SA-2021-1807)	Nessus	Huawei Local Security Checks	medium
146384	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : JUnit 4 vulnerability (USN-4731-1)	Nessus	Ubuntu Local Security Checks	medium
142206	Debian DLA-2426-1 : junit4 security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-15250

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium