You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@flink.apache.org by "Roman Khachatryan (Jira)" <ji...@apache.org> on 2026/08/11 08:30:00 UTC

[jira] [Assigned] (FLINK-37666) Address CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation

     [ https://issues.apache.org/jira/browse/FLINK-37666?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Roman Khachatryan reassigned FLINK-37666:
-----------------------------------------

    Assignee: Samrat Deb

> Address CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation
> ------------------------------------------------------------------------------------------------
>
>                 Key: FLINK-37666
>                 URL: https://issues.apache.org/jira/browse/FLINK-37666
>             Project: Flink
>          Issue Type: Improvement
>            Reporter: Atul Sharma
>            Assignee: Samrat Deb
>            Priority: Major
>              Labels: pull-request-available
>
> Currently, the Flink codebase uses File.createTempFile at many places for creating temporary files. 
> This approach may result in temporary files being created with default system permissions, which could potentially expose them to unauthorized access. 
> This is a security concern identified as CWE-378: Creation of Temporary File With Insecure Permissions.
> Classes Affected: PackagedProgram.java, YarnClusterDescriptor.java, ChangelogStreamHandleReaderWithCache, StreamWindowSQLExample 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)