Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.datadoghq:datadog-api-client

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.0MavenPublished

    Local Information Disclosure Vulnerability

    CVE-2021-21331 · GHSA-2cxf-6567-7pp6

    Affected
    • Maven com.datadoghq:datadog-api-client >= 1.0.0-beta.6, < 1.0.0-beta.9
    Fixed in
    1.0.0-beta.9· Vendor fix available
    Issue
    Impact Local information disclosure of sensitive information downloaded via the API using the API Client. Finding The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the downloadFileFromResponse method will be visible to all other users on the local system. Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. This vulnerability was found due to this query that Jonathan Leitschuh contributed to…

    Recommended action: Upgrade to 1.0.0-beta.9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →