Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-28099

In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, sinc

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
netflix

Description

In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Netflix OSS Hollow

  • All versionsaffected

References