Fluid Attacks Database

Description

Incorrect Default Permissions in JetBrains Kotlin In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	kotlin	>=0 <1.3.31+ds1-3	1.3.31+ds1-3
maven	org.jetbrains.kotlin:kotlin-stdlib	>=0 <1.4.21	1.4.21
debian 12	kotlin	=1.3.31+ds1-1 \|\| =1.3.31+ds1-2 \|\| =1.3.31+ds1-3	-

Aliases

1. CVE-2020-295822. NVD-2020-295823. OSV-DEBIAN-2020-295824. OSV-2020-295825. GCVE-2020-295826. SECURITY-TRACKER-CVE-2020-29582

References

1. https://blog.jetbrains.com2. https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-20203. https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E4. https://www.oracle.com//security-alerts/cpujul2021.html5. https://www.oracle.com/security-alerts/cpuapr2022.html6. https://www.oracle.com/security-alerts/cpujan2022.html