{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "Incorrect permission assignment for symlinked files used in copy or archiving operations",
    "tracking": {
      "current_release_date": "2026-08-11T17:15:35+00:00",
      "generator": {
        "date": "2026-08-11T17:15:35+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2023-44387",
      "initial_release_date": "2023-10-05T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T17:15:35+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Software Collections",
            "product": {
              "name": "Red Hat Software Collections",
              "product_id": "rhscl-3",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:rhel_software_collections:3"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rh-maven36-byte-buddy",
            "product": {
              "name": "rh-maven36-byte-buddy",
              "product_id": "rh-maven36-byte-buddy",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rh-maven36-byte-buddy"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rh-maven36-byte-buddy-agent",
            "product": {
              "name": "rh-maven36-byte-buddy-agent",
              "product_id": "rh-maven36-byte-buddy-agent",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rh-maven36-byte-buddy-agent"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rh-maven36-byte-buddy-javadoc",
            "product": {
              "name": "rh-maven36-byte-buddy-javadoc",
              "product_id": "rh-maven36-byte-buddy-javadoc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rh-maven36-byte-buddy-javadoc"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rh-maven36-byte-buddy-maven-plugin",
            "product": {
              "name": "rh-maven36-byte-buddy-maven-plugin",
              "product_id": "rh-maven36-byte-buddy-maven-plugin",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rh-maven36-byte-buddy-maven-plugin"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rh-maven36-byte-buddy-parent",
            "product": {
              "name": "rh-maven36-byte-buddy-parent",
              "product_id": "rh-maven36-byte-buddy-parent",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rh-maven36-byte-buddy-parent"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rh-maven36-byte-buddy",
            "product": {
              "name": "rh-maven36-byte-buddy",
              "product_id": "rh-maven36-byte-buddy.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rh-maven36-byte-buddy?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-byte-buddy as a component of Red Hat Software Collections",
          "product_id": "rhscl-3:rh-maven36-byte-buddy"
        },
        "product_reference": "rh-maven36-byte-buddy",
        "relates_to_product_reference": "rhscl-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-byte-buddy-agent as a component of Red Hat Software Collections",
          "product_id": "rhscl-3:rh-maven36-byte-buddy-agent"
        },
        "product_reference": "rh-maven36-byte-buddy-agent",
        "relates_to_product_reference": "rhscl-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-byte-buddy-javadoc as a component of Red Hat Software Collections",
          "product_id": "rhscl-3:rh-maven36-byte-buddy-javadoc"
        },
        "product_reference": "rh-maven36-byte-buddy-javadoc",
        "relates_to_product_reference": "rhscl-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-byte-buddy-maven-plugin as a component of Red Hat Software Collections",
          "product_id": "rhscl-3:rh-maven36-byte-buddy-maven-plugin"
        },
        "product_reference": "rh-maven36-byte-buddy-maven-plugin",
        "relates_to_product_reference": "rhscl-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-byte-buddy-parent as a component of Red Hat Software Collections",
          "product_id": "rhscl-3:rh-maven36-byte-buddy-parent"
        },
        "product_reference": "rh-maven36-byte-buddy-parent",
        "relates_to_product_reference": "rhscl-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-byte-buddy.src as a component of Red Hat Software Collections",
          "product_id": "rhscl-3:rh-maven36-byte-buddy.src"
        },
        "product_reference": "rh-maven36-byte-buddy.src",
        "relates_to_product_reference": "rhscl-3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-44387",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "discovery_date": "2023-10-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhscl-3:rh-maven36-byte-buddy-javadoc"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Gradle. When copying files or creating archives, Gradle does not preserve symbolic links, instead resolving them to their underlying target file, but permissions of the new file use those of the link instead of those from the target file. This issue can lead to files with broader permissions than intended, as symbolic links are usually world-readable and writeable.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "rhscl-3:rh-maven36-byte-buddy",
          "rhscl-3:rh-maven36-byte-buddy-agent",
          "rhscl-3:rh-maven36-byte-buddy-maven-plugin",
          "rhscl-3:rh-maven36-byte-buddy-parent",
          "rhscl-3:rh-maven36-byte-buddy.src"
        ],
        "known_not_affected": [
          "rhscl-3:rh-maven36-byte-buddy-javadoc"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-44387"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44387"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-44387"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "rhscl-3:rh-maven36-byte-buddy",
            "rhscl-3:rh-maven36-byte-buddy-agent",
            "rhscl-3:rh-maven36-byte-buddy-maven-plugin",
            "rhscl-3:rh-maven36-byte-buddy-parent",
            "rhscl-3:rh-maven36-byte-buddy.src"
          ]
        },
        {
          "category": "workaround",
          "details": "User should follow the documentation to explicitly set permissions when copying or create archives: https://docs.gradle.org/current/userguide/working_with_files.html#sec:setting_file_permissions",
          "product_ids": [
            "rhscl-3:rh-maven36-byte-buddy",
            "rhscl-3:rh-maven36-byte-buddy-agent",
            "rhscl-3:rh-maven36-byte-buddy-maven-plugin",
            "rhscl-3:rh-maven36-byte-buddy-parent",
            "rhscl-3:rh-maven36-byte-buddy.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
            "baseScore": 3.2,
            "baseSeverity": "LOW"
          },
          "products": [
            "rhscl-3:rh-maven36-byte-buddy",
            "rhscl-3:rh-maven36-byte-buddy-agent",
            "rhscl-3:rh-maven36-byte-buddy-javadoc",
            "rhscl-3:rh-maven36-byte-buddy-maven-plugin",
            "rhscl-3:rh-maven36-byte-buddy-parent",
            "rhscl-3:rh-maven36-byte-buddy.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low",
          "product_ids": [
            "rhscl-3:rh-maven36-byte-buddy",
            "rhscl-3:rh-maven36-byte-buddy-agent",
            "rhscl-3:rh-maven36-byte-buddy-javadoc",
            "rhscl-3:rh-maven36-byte-buddy-maven-plugin",
            "rhscl-3:rh-maven36-byte-buddy-parent",
            "rhscl-3:rh-maven36-byte-buddy.src"
          ]
        }
      ],
      "title": "Incorrect permission assignment for symlinked files used in copy or archiving operations"
    }
  ]
}