Skip to content
Fencer Intel
medium 4.4

CVE-2013-2035 json

Improper Control of Generation of Code in HawtJNI

published 13y ago modified 4mo ago also GHSA-49j7-qghp-5wj8 , EUVD-2022-2345

cvss
4.4
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.

Patch / fix

  • maven org.fusesource.hawtjni:hawtjni-runtime 1.8
  • hawtjni Debian 14, Debian 13, Debian 12 1.10-1

debian advisories DEBIAN-CVE-2013-2035

  • hawtjni Ubuntu 14.04 LTS 1.0~+git0c502e20c4-3+deb7u1build0.14.04.1

ubuntu advisories UBUNTU-CVE-2013-2035

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • activemq openshift 2.0, openshift 1.2 5.9.0-4.redhat.610328.el6op
  • activemq-client openshift 2.0, openshift 1.2 5.9.0-4.redhat.610328.el6op
  • xom jboss enterprise application platform 6 1.2.7-2.redhat_4.1.ep6.el6
  • jansi jboss enterprise application platform 6 1.9-5.redhat_3.1.ep6.el6
  • jaxen jboss enterprise application platform 6 1.1.3-9.redhat_3.1.ep6.el6
  • juddi jboss enterprise application platform 6 3.1.3-4.redhat_3.1.ep6.el6
  • wss4j jboss enterprise application platform 6 1.6.12-1.redhat_1.1.ep6.el6
  • mod_jk jboss enterprise application platform 6 1.2.37-4.redhat_3.ep6.el6

red hat advisories RHSA-2014:0245RHSA-2014:0254RHSA-2013:1786RHSA-2013:1785

Is CVE-2013-2035 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-2035 updated cvss 3.3

HawtJNI: predictable temporary file name leading to local arbitrary code execution

  • Red Hat OpenShift Enterprise 1 jansi, hawtjni
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 6 jansi
    affected: no fix available
  • Red Hat JBoss SOA Platform 5 jruby jruby
    affected: no fix planned “Will not fix”
  • Red Hat Fuse MQ Enterprise 7.1.0
    fixed: vendor fix RHSA-2013:1029
  • Red Hat JBoss A-MQ 6.1
    fixed: vendor fix RHSA-2014:0401
  • Red Hat JBoss BPMS 6.0
    fixed: vendor fix RHSA-2014:1291
  • Red Hat JBoss BRMS 6.0
    fixed: vendor fix RHSA-2014:1290
  • Red Hat JBoss Data Grid 6.2
    fixed: vendor fix RHSA-2014:0029
show 9 more
  • Red Hat JBoss Data Virtualization 6.0
    fixed: vendor fix RHSA-2015:0034
  • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server jansi 1.9-5.redhat_3.1.ep6.el5, xom 1.2.7-2.redhat_4.1.ep6.el5, jaxen 1.1.3-9.redhat_3.1.ep6.el5, juddi 3.1.3-4.redhat_3.1.ep6.el5, mod_jk 1.2.37-4.redhat_3.ep6.el5, openws 1.4.4-2.redhat_2.1.ep6.el5, +173 more
    fixed: vendor fix RHSA-2013:1785
  • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server jansi 1.9-5.redhat_3.1.ep6.el6, xom 1.2.7-2.redhat_4.1.ep6.el6, jaxen 1.1.3-9.redhat_3.1.ep6.el6, juddi 3.1.3-4.redhat_3.1.ep6.el6, mod_jk 1.2.37-4.redhat_3.ep6.el6, openws 1.4.4-2.redhat_2.1.ep6.el6, +172 more
    fixed: vendor fix RHSA-2013:1786
  • Red Hat JBoss Enterprise Application Platform 6.2
    fixed: vendor fix RHSA-2013:1784
  • Red Hat JBoss Fuse 6.1
    fixed: vendor fix RHSA-2014:0400
  • Red Hat JBoss Fuse Service Works 6.0
    fixed: vendor fix RHSA-2014:1995
  • Red Hat JBoss Operations Network 3.3
    fixed: vendor fix RHSA-2014:1904
  • Red Hat OpenShift Enterprise Node activemq 5.9.0-4.redhat.610328.el6op, activemq-client 5.9.0-4.redhat.610328.el6op Red Hat RHOSE Infrastructure 1.2 activemq 5.9.0-4.redhat.610328.el6op, activemq-client 5.9.0-4.redhat.610328.el6op
    fixed: vendor fix RHSA-2014:0254
  • Red Hat RHOSE Infrastructure 2.0 activemq 5.9.0-4.redhat.610328.el6op, activemq-client 5.9.0-4.redhat.610328.el6op Red Hat RHOSE Node 2.0 activemq 5.9.0-4.redhat.610328.el6op, activemq-client 5.9.0-4.redhat.610328.el6op
    fixed: vendor fix RHSA-2014:0245

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/fusesource/hawtjni/commit/92c266170ce98edc200c656bd034a237098b8aa5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.fusesource.hawtjni:hawtjni-runtime
<1.8
1.8

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.