CVE-2020-29582
Fixed in a distro release EPSS 3%
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
Products: jetbrains kotlin, oracle communications_cloud_native_core_network_slice_selection_function, oracle communications_cloud_native_core_policy, oracle communications_cloud_native_core_service_communication_proxy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jetbrains.kotlin:kotlin-stdlib | 1.4.21 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-3.0 | no fix |
| Chainguard | eco-java-gradle-3.1 | no fix |
| Chainguard | eco-java-gradle-3.2 | no fix |
| Chainguard | eco-java-gradle-3.2.1 | no fix |
| Chainguard | eco-java-gradle-3.3 | no fix |
| Chainguard | eco-java-gradle-3.4 | no fix |
| Chainguard | eco-java-gradle-3.4.1 | no fix |
| Chainguard | eco-java-gradle-3.5 | no fix |
| Chainguard | eco-java-gradle-3.5.1 | no fix |
| Chainguard | eco-java-gradle-4.0 | no fix |
| Chainguard | eco-java-gradle-4.0.1 | no fix |
| Chainguard | eco-java-gradle-4.0.2 | no fix |
| Chainguard | thingsboard | 3.7-r1 |
| Chainguard | thingsboard-tb-js-executor | 3.7-r1 |
| Chainguard | thingsboard-tb-mqtt-transport | 3.7-r1 |
| Chainguard | thingsboard-tb-node | 3.7-r1 |
| Chainguard | thingsboard-tb-web-ui | 3.7-r1 |
| Debian 12 | kotlin | no fix |
| Debian 13 | kotlin | 1.3.31+ds1-3 |
| Debian 14 | kotlin | 1.3.31+ds1-3 |
| Ubuntu 22.04 LTS | kotlin | no fix |
| Ubuntu 24.04 LTS | kotlin | no fix |
| Ubuntu 25.10 | kotlin | no fix |
| Ubuntu 26.04 LTS | kotlin | no fix |
| Ubuntu 26.10 | kotlin | no fix |
| Wolfi | thingsboard | 3.7-r1 |
| Wolfi | thingsboard-tb-js-executor | 3.7-r1 |
| Wolfi | thingsboard-tb-mqtt-transport | 3.7-r1 |
| Wolfi | thingsboard-tb-node | 3.7-r1 |
| Wolfi | thingsboard-tb-web-ui | 3.7-r1 |