NVD Vulnerability Detail

CVE-2021-21430

Summary	OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: `java` (jersey2, okhttp-gson (default library)), `scala-finch`. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.
Publication Date	May 11, 2021, 5:15 a.m.
Registration Date	May 11, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 2:48 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:openapi-generator:openapi_generator::::::::					5.1.1

Related information, measures and tools

No	URL	タグ
1	https://github.com/OpenAPITools/openapi-generator/pull/8787	Patch Third Party Advisory
2	https://github.com/OpenAPITools/openapi-generator/pull/8787	Patch Third Party Advisory
3	https://github.com/OpenAPITools/openapi-generator/pull/8791	Patch Third Party Advisory
4	https://github.com/OpenAPITools/openapi-generator/pull/8791	Patch Third Party Advisory
5	https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-cqxr-xf2w-943w	Exploit Third Party Advisory
6	https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-cqxr-xf2w-943w	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-668	誤った領域へのリソースの漏えい	https://cwe.mitre.org/data/definitions/668.html

JVN Vulnerability Information

OpenAPI Generator における権限管理に関する脆弱性

Title	OpenAPI Generator における権限管理に関する脆弱性
Summary	OpenAPI Generator には、権限管理に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 10, 2021, midnight
Registration Date	Jan. 19, 2022, 6:09 p.m.
Last Update	Jan. 19, 2022, 6:09 p.m.

Affected System

OpenAPI-Generator Contributors

OpenAPI Generator

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-21430	https://www.cve.org/CVERecord?id=CVE-2021-21430
National Vulnerability Database (NVD)
2	CVE-2021-21430	https://nvd.nist.gov/vuln/detail/CVE-2021-21430

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-269	https://cwe.mitre.org/data/definitions/269.html

ベンダー情報

No	Name	URL
GitHub
1	Generated Java and Scala Code Contains Local Information Disclosure Vulnerability	https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-cqxr-xf2w-943w
2	[Java] use Files.createTempFile instead #8787	https://github.com/OpenAPITools/openapi-generator/pull/8787
3	[Scala][Finch] use Files.createTempFile to avoid potential security issues #8791	https://github.com/OpenAPITools/openapi-generator/pull/8791

Change Log

No	Changed Details	Date of change
1	[2022年01月19日] 掲載	Jan. 19, 2022, 6:09 p.m.