CVE catalog
CVE-2020-8908
guava-libraries: CVE-2020-8908
- Severity
- Medium · CVSS 4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.92% · Oct 25, 2026
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | guava-libraries | sid | 33.7.1-1 | fixed |
| Debian | guava-libraries | forky | 33.7.1-1 | fixed |
| Debian | guava-libraries | trixie | 32.0.1-1 | fixed |
| Debian | guava-libraries | bookworm | 31.1-1 | vulnerable |
| Suse | guava | manager server module 4.3 | 32.0.1-150400.3.3.1 | fixed |
| Suse | guava | linux enterprise module for development tools 15 sp4 | 32.0.1-150200.3.7.1 | fixed |
| Suse | guava | linux enterprise module for development tools 15 sp5 | 32.0.1-150200.3.7.1 | fixed |
| Suse | guava | linux enterprise real time 15 sp3 | 32.0.1-150200.3.7.1 | fixed |
| Opensuse | guava | leap 15.4 | 32.0.1-150200.3.7.1 | fixed |
| Opensuse | guava | leap 15.5 | 32.0.1-150200.3.7.1 | fixed |
| Opensuse | guava | tumbleweed | 30.1.1-1.2 | fixed |
| Ubuntu | guava-libraries | 14.04 | 14.0.1-1 | vulnerable |
| Ubuntu | guava-libraries | 14.04 | 15.0-2ubuntu1 | vulnerable |
| Ubuntu | guava-libraries | 16.04 | 18.0-4ubuntu1 | vulnerable |
| Ubuntu | guava-libraries | 16.04 | 19.0-1 | vulnerable |
| Ubuntu | guava-libraries | 18.04 | 19.0-1 | vulnerable |
| Ubuntu | guava-libraries | 20.04 | 19.0-1 | vulnerable |
| Ubuntu | guava-libraries | 22.04 | 29.0-6 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | guava-libraries | source | sid | 32.0.1-1 | not yet assigned | Not reported | [1038979] |
| Debian | guava-libraries | source | forky | 32.0.1-1 | not yet assigned | Not reported | [1038979] |
| Debian | guava-libraries | source | trixie | 32.0.1-1 | not yet assigned | Not reported | [1038979] |
| Debian | guava-libraries | source | bookworm | (unfixed) | not yet assigned | Not reported | [1038979] |
| Suse | guava | rpm | manager server module 4.3 | 32.0.1-150400.3.3.1 | Not reported | SUSE-SU-2024:1138-1 | Not reported |
| Suse | guava | rpm | linux enterprise module for development tools 15 sp4 | 32.0.1-150200.3.7.1 | Not reported | SUSE-SU-2023:3090-1 | Not reported |
| Suse | guava | rpm | linux enterprise module for development tools 15 sp5 | 32.0.1-150200.3.7.1 | Not reported | SUSE-SU-2023:3090-1 | Not reported |
| Suse | guava | rpm | linux enterprise real time 15 sp3 | 32.0.1-150200.3.7.1 | Not reported | SUSE-SU-2023:3090-1 | Not reported |
| Opensuse | guava | rpm | leap 15.4 | 32.0.1-150200.3.7.1 | Not reported | SUSE-SU-2023:3090-1 | Not reported |
| Opensuse | guava | rpm | leap 15.5 | 32.0.1-150200.3.7.1 | Not reported | SUSE-SU-2023:3090-1 | Not reported |
| Opensuse | guava | rpm | tumbleweed | 30.1.1-1.2 | Not reported | OPENSUSE-SU-2024:10835-1 | Not reported |
Notes
[bookworm] guava-libraries: Minor issue, mitigated by kernel tmp hardening
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libguava-java]Unknown
Source package: [guava-libraries]
Details (2)
31.1-1· all · bookwormAffected
dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
31.1-1· all · bookwormAffected
dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
- [libguava-testlib-java]Unknown
Source package: [guava-libraries]
Details (2)
31.1-1· all · bookwormAffected
dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
31.1-1· all · bookwormAffected
dsa · guava-libraries · debian · bookworm; dsa · guava-libraries · debian · 12
[Debian 13 (Trixie)]
- [libguava-java]Unknown
Source package: [guava-libraries]
Details (2)
32.0.1-1· all · trixieFixed · Fixed:
32.0.1-1dsa · guava-libraries · debian · 13
32.0.1-1· all · trixieFixed · Fixed:
32.0.1-1dsa · guava-libraries · debian · 13
- [libguava-testlib-java]Unknown
Source package: [guava-libraries]
Details (2)
32.0.1-1· all · trixieFixed · Fixed:
32.0.1-1dsa · guava-libraries · debian · 13
32.0.1-1· all · trixieFixed · Fixed:
32.0.1-1dsa · guava-libraries · debian · 13
[openSUSE Tumbleweed]
- [guava]Unknown
Source package: [guava]
Details (1)
33.4.8-1.5· noarch · tumbleweedFixed · Fixed:
30.1.1-1.2dsa · guava · opensuse · tumbleweed
- [guava-javadoc]Unknown
Source package: [guava]
Details (1)
33.4.8-1.5· noarch · tumbleweedUnknown · Fixed:
30.1.1-1.2Version impact unknown
dsa · guava · opensuse · tumbleweed
- [guava-testlib]Unknown
Source package: [guava]
Details (1)
33.4.8-1.5· noarch · tumbleweedUnknown · Fixed:
30.1.1-1.2Version impact unknown
dsa · guava · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_3090-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2020-8908]
- [https://osv.dev/vulnerability/SUSE-SU-2023:3090-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1138-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-8908]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:10835-1]
- [https://security-tracker.debian.org/tracker/CVE-2020-8908]
- [https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-8908.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0794.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]