Vulnerability · Published Jan 11, 2021 · Assigned by apache
CVE-2020-17534
High 7.0
In plain English
A high-severity security flaw in Apache NetBeans HTML/Java API. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file: https://github.com/apache/netbeans-html4j/commit/fa70e507e5555e1adb4f6518479fc408a7abd0e6
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.netbeans.html:pom | 1.7.1 | GHSA-ppc3-fpvh-7396 |
| Ubuntu:22.04:LTS | netbeans | no fix listed | UBUNTU-CVE-2020-17534 |
| Ubuntu:24.04:LTS | netbeans | no fix listed | UBUNTU-CVE-2020-17534 |
| Ubuntu:25.10 | netbeans | no fix listed | UBUNTU-CVE-2020-17534 |
| Ubuntu:26.04:LTS | netbeans | no fix listed | UBUNTU-CVE-2020-17534 |
| Ubuntu:26.10 | netbeans | no fix listed | UBUNTU-CVE-2020-17534 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache NetBeans HTML/Java API | v1.7 |