CVE-2021-22572

Name of the Vulnerable Software and Affected Versions data-transfer-project versions prior to the version including commit https://github.com/google/data-transfer-project/pull/969

Description The issue arises on unix-like systems where the system temporary directory is shared among all users, allowing any sensitive information written to these files to be visible to all other local users. This occurs because File.createTempFile creates files in the system temporary directory with world-readable permissions.

Recommendations Upgrade past commit https://github.com/google/data-transfer-project/pull/969 to resolve the issue. As a temporary workaround, consider restricting access to the system temporary directory to minimize the risk of sensitive information exposure.