at.molindo:esi4j (>=3.0.0, <=3.0.2), at.molindo:scrutineer (3.0.0) +9 more potentially affected by CVE-2022-24913 via com.fasterxml.util:java-merge-sort (>=1.0.0, <=1.0.2)

com.fasterxml.util:java-merge-sort MAVEN version =1.0.0, =3.0.0, =6.5.0, =2.3.0, =0.5.3, =0.5.3, =0.9.0, =0.5.3, =0.5.3, =0.9.0, =1.0.2, =1.0.4 Source cves: CVE-2022-24913 Source advisory: GHSA-QXXC-7MQ4-MF79...

at.molindo:esi4j (>=0.3.0-alpha-1, <=2.0.3), at.molindo:scrutineer (2.0.0) +1 more potentially affected by CVE-2022-24913 via com.fasterxml.util:java-merge-sort (0.7.1)

com.fasterxml.util:java-merge-sort MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.util:java-merge-sort and may be impacted: - at.molindo:esi4j =0.3.0-alpha-1, =1.0.3, =1.0.5 Source cves: CVE-2022-24913 Source advisory...

CVE-2022-24913

CVE-2022-24913 affects com.fasterxml.util:java-merge-sort (versions before 1.1.0). The root cause is an insecure temporary file handling in StdTempFileProvider.java using File.createTempFile(), which can expose temporary file contents (confidentiality impact HIGH). Remediation: upgrade to 1.1.0 o...

CVE-2022-24913

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider function in StdTempFileProvider.java, which uses the permissive File.createTempFile function, exposing temporary file contents...