fix(deps): update dependency org.glassfish.jersey.core:jersey-common to v2.34 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.glassfish.jersey.core:jersey-common (source)	2.30.1 -> 2.34

GitHub Vulnerability Alerts

CVE-2021-28168

Impact

Eclipse Jersey 2.28 - 2.33 and Eclipse Jersey 3.0.0 - 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

Workaround

This issue can be mitigated by manually setting the java.io.tmpdir system property when launching the JVM.

Patches

Jersey 2.34 and 3.0.2 forward sets the correct permissions on the temporary file created by Jersey.

References

• https://github.com/eclipse-ee4j/jersey/pull/4712
• CWE-378: Creation of Temporary File With Insecure Permissions
• CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Similar Vulnerabilities

Similar, but not the same:

• JUnit 4 - GHSA-269g-pwp5-87pp
• Google Guava - https://github.com/google/guava/issues/4011
• Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945
• JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824
• Eclipse Jetty - GHSA-g3wg-6mcf-8jj6

---

Original Disclosure:

Hello Jersey Security Team,

Utilizing a custom CodeQL query written as a part of the GitHub Security Lab Bug Bounty program, I've unearthed a local temporary file information disclosure vulnerability.

You can see the custom CodeQL query utilized here:
https://lgtm.com/query/8831016213790320486/

This particular vulnerability exists because on unix-like systems (not including modern versions of MacOS) the system temporary directory is shared between all users. As such, failure to correctly set file permissions and/or verify exclusive creation of directories can lead to either local information disclosure, or local file hijacking by another user.

This vulnerability impacts the following locations in this project's source:

• https://github.com/eclipse-ee4j/jersey/blob/01c6a32a2064aeff2caa8133472e33affeb8a29a/core-common/src/main/java/org/glassfish/jersey/message/internal/FileProvider.java#L64-L73
• https://github.com/eclipse-ee4j/jersey/blob/01c6a32a2064aeff2caa8133472e33affeb8a29a/media/multipart/src/main/java/org/glassfish/jersey/media/multipart/internal/FormDataParamValueParamProvider.java#L202-L208

This vulnerability exists because of the vulnerability in the Utils.createTempFile:

https://github.com/eclipse-ee4j/jersey/blob/01c6a32a2064aeff2caa8133472e33affeb8a29a/core-common/src/main/java/org/glassfish/jersey/message/internal/Utils.java#L42-L53

This is because File.createTempFile creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system.

If there is sensitive information written to these files, it is disclosed to other local users on this system.

The fix for this vulnerability is to use the Files API (instead of the File API) to create temporary files/directories as this new API correctly sets the posix file permissions.

---

Release Notes

eclipse-ee4j/jersey (org.glassfish.jersey.core:jersey-common)

v2.34

Compare Source

[Issue 4646] - Jetty connector client response buffer is hard limited to 2MB

[Issue 4649] - SseEventSource cannot see the JAXRS_DEFAULT_SSE_BUILDER in OSGI

[Issue 4651] - Add a ParamConverterProvider for java.util.Optional parameters

[Issue 4654] - MicroProfile Rest Client 2.0 support

[Issue 4665] - Hk2RequestScope.Instance logger is not static

[Issue 4678] - JdkConnectorProvider cannot parse Set-cookie header value when expires attribute is present

[Issue 4683] - Setting ExecutorService causes connection leak

[Issue 4694] - NettyConnector fixups

[Issue 4717] - Add tests for newly updated Jersey classes by RestClient

[Issue 4722] - Jersey 3.0.1 no longer defaults to */* consumes

[Issue 4723] - Jackson module auto-discovery sets Jaxb Annotation Introspector as primary

[Issue 4734] - Print request/response logs in a single line

[Pull 4618] - Groovy jdk 16

[Pull 4639] - Chapter for Expect:100-continue header (client)

[Pull 4647] - Add support RFC 5987 for attribute filename* in HTTP header Content-Disposition

[Pull 4662] - #​4658 Apache HttpComponents upgrade

[Pull 4675] - Make logger static into Hk2RequestScope.Instance class

[Pull 4677] - Jetty synchronous max buffer size property

[Pull 4680] - 2.x apidocs bundle generation fixes

[Pull 4681] - JdkConnectorProvider cannot parse Set-cookie header value when expires

[Pull 4682] - Public SseEventSourceBuilder implementation

[Pull 4684] - Add a ParamConverterProvider for array support

[Pull 4690] - Add a ParamConverterProvider for java.util.Optional parameters

[Pull 4695] - Allow for having CDI on pure Jersey Client without Jersey Server

[Pull 4697] - Stop filling monitoring queues when processor fails

[Pull 4699] - MicroProfile Rest Client 2.0 support

[Pull 4704] - Updated javadoc maven plugin API link

[Pull 4705] - Do not create a connector multiple times for each rx() call

[Pull 4707] - Configurable COLLISION_BUFFER_POWER

[Pull 4710] - Adjusting Jersey archetypes

[Pull 4712] - switching to NIO tmp file creation approach

[Pull 4714] - update maven-antrun-plugin to 3.0.0

[Pull 4716] - Custom schedulers to execute @​PreDestroy methods

[Pull 4720] - Updating ant to 1.10.9 for antrun plugin

[Pull 4724] - Rest client 2.0 updates

[Pull 4728] - Add a wildcard @​Produces and @​Consumes...

[Pull 4729] - Empty/NULL properties handling

[Pull 4731] - processing order for Jackson/Jaxb annotations

[Pull 4732] - adjusting examples to be run with optional JAXB

[Pull 4745] - Logging delimiter parametrized

[Pull 4749] - Allow to use @​Inject instead of @​Context with CDI

[Pull 4753] - Proper handling of chunked input streams in LoggingInterceptor

[Pull 4754] - Adopt ASM 9.1 to support JDK 17

[Pull 4758] - Adopted Jackson 2.12.2. No change in repackaged Jackson.

[Pull 4762] - Replace null Configuration in ContainerRequest with an empty instance

[Pull 4764] - Lazy synchronized SSL Context initialization in the HttpUrlConnector

[Pull 4766] - Add a default Enum MB provider.

[Pull 4769] - Updated properties for netty connection pooling

[Pull 4770] - Javadoc for non-public classes (cdi-rs-inject)

v2.33

Compare Source

[Pull 4566] - Fix custom SSLSocketFactory not being set because of an unsafe lazy-initialization in JDK

[Pull 4573] - Support for SSL Configuration within JerseyTest

[Pull 4593] - Rest client inbound headers provider added

[Pull 4605] - Bump junit from 4.12 to 4.13.1

[Pull 4611] - Create PropertiesClass for external properties (http.proxyHost, http.proxyPort, http.nonProxyHosts)

[Pull 4612] - Adopt Jackson 2.11.3

[Pull 4613] - HttpUrlConnector extension

[Pull 4614] - NettyConnector connection close

[Pull 4615] - Allow for org.glassfish.jersey.servlet.ServletContainer in web.xml

[Pull 4623] - full clear of NettyInputStream

[Pull 4634] - Make JAX-B API optional

[Pull 4641] - Support for new property to ignore responses in exceptions thrown by the Client API

[Pull 4643] - Enable CompletionStage unwrap in MBW

[Pull 4648] - Keep ordering of classes and instances retrieved from ComponentBag

[Pull 4663] - Modify OSGi Jackson requirement to be compatible with GF 5.1

v2.32

Compare Source

[Issue 4462] - InvocationInterceptors only used once when registered on a Client.

[Issue 4493] - ChunkedOutput race condition

[Issue 4500] - JerseyEventSink shouln't throw exceptions in Flow.Subscriber methods

[Issue 4501] - SSE Endpoint should be able to inject Flow.Subscriber

[Issue 4507] - Intermittent HK2 ServiceLocatorImpl has been shut down

[Issue 4522] - org.glassfish.jersey.logging.LoggingInterceptor.LoggingStream does not override write(byte[] b, int off, int len)

[Issue 4533] - “NoSuchMethodErrors” due to multiple versions of org.apache.maven:maven-artifact:jar

[Issue 4536] - Missing Expect header and 100-continue handling in Jersey Client

[Issue 4538] - Features are executed in random order

[Issue 4542] - Loose dependency in CompositeInjectingConstraintValidatorFactory

[Issue 4548] - Netty connector timeouts are not heeded

[Pull 4485] - Note the subscription to email list and Twitter link in Readme

[Pull 4498] - Fix resources in containers

[Pull 4502] - Added Documentation for JSON-B support

[Pull 4503] - SSE Flow.Subscriber injectable as event sink

[Pull 4506] - Clean unused dependencies

[Pull 4508] - Fix intermittent premature ClientRuntime finalization

[Pull 4511] - Fixed HK2 AbstractActiveDescriptor Test

[Pull 4512] - project-info plugin configuration

[Pull 4514] - Implemented ClientBuilderListener

[Pull 4520] - Test Gzip + JSP

[Pull 4523] - Response.hasEntity to return true if buffered after readEntity

[Pull 4525] - Allow concurrent Exception to be unwrapped for the ExceptionMapper

[Pull 4526] - Regexp on MP RestClient @​Path

[Pull 4528] - Support TLSv1.3

[Pull 4531] - Fix #​4522 - override write method in LoggingStream

[Pull 4540] - Allow for specifying Feature processing order

[Pull 4541] - Make Kryo use setRegistrationRequired(true) by default

[Pull 4543] - Rest client update to version 1.4.1

[Pull 4559] - Updating maven-javadoc-pugin to 3.2.0

[Pull 4561] - JAX-RS link fixes (new apidocs location)

[Pull 4567] - updateing dependencies for jersey-doc-modulelist-maven-plugin

[Pull 4569] - Use Helidon Connector from Helidon

[Pull 4571] - Prevent race condition in ChunkedOutput

[Pull 4574] - Fix issue with optional CDI in BV module

[Pull 4576] - Expect:100-Continue header handling

[Pull 4577] - RestClientListener call switched

[Pull 4578] - TimeOut property for Netty Connector

[Pull 4579] - attributeValue NPE handling

[Pull 4580] - Put Helidon Properties file back

[Pull 4581] - Support Apache HttpEntity as an entity type when using Apache Connector

[Pull 4582] - Add Helidon module to bom pom and remove Jackson 1

v2.31

Compare Source

[Issue 4362] - Upgrade Hibernate Validator to 6.1.0.Final

[Issue 4458] - ApacheConnector force the useSystemProperties flag to false

[Pull 4375] - Fixed #​3801 - inject cdi into custom validator

[Pull 4414] - Use standard pom.xml structure in tests/integration/microprofile

[Pull 4415] - Use request scope ClientProperties.READ_TIMEOUT in Jetty && Netty

[Pull 4419] - Allow to use HeaderDelegateProvider to parse the response MediaType

[Pull 4425] - Updated GF, Jetty, Mimepull, Moxy, Yasson dependencies

[Pull 4426] - Support jdk15

[Pull 4429] - Make sure the RX invoker gets ExecutorService from Provider

[Pull 4431] - Adopt ASM 8.0

[Pull 4432] - Upgraded bean validation to 6.1.2.Final

[Pull 4438] - Fix jersey examples

[Pull 4441] - Fix some build warnings and a multithread warning, when building with…

[Pull 4442] - JerseyInvocation should override toString()

[Pull 4447] - feat: allow json-jackson to auto-discover modules

[Pull 4450] - When no JAX-B RI on CP warn and disable WADL

[Pull 4453] - jersey-2031

[Pull 4459] - Activate useSystemProperties into ApacheConnector (#​4458)

[Pull 4460] - Offer the Client (partial) response in ProcessingException.

[Pull 4461] - Allow the user for overriding the default Viewable MediaType

[Pull 4466] - Updated NOTICE files and regarding legal information

[Pull 4467] - Be able to use invocation interceptor for multiple requests

[Pull 4469] - ClientDestroyTest fix

[Pull 4471] - Run tests with JDK11 in servlet-2.5-mvc-1

[Pull 4472] - Set additional security features on SecureSaxParserFactory.

[Pull 4473] - Execute tests in servlet-2.5-mvc-3

[Pull 4475] - Set Bundle-ActivationPolicy on core-common module

[Pull 4477] - Connector to Helidon 2 Web Client

[Pull 4482] - javadoc fix for helidon connector

[Pull 4483] - Moved localization messages to a proper folder

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.