Security Bulletin: Vulnerabilities in Google Guava 11.0 through 24.x before 24.1.1

2019-07-2402:00:01

www.ibm.com

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

JSON

Summary

There are vulnerabilities in Google Guava 11.0 through 24.x before 24.1.1 used by IBM Streams. IBM Streams has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2018-10237 DESCRIPTION: Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArray and CompoundOrdering class. By sending a specially-crafted data, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/142508> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected InfoSphere/IBM Streams	Versions
InfoSphere Streams	4.0.1.6 and earlier
InfoSphere Streams	3.2.1.6 and earlier
IBM Streams	4.1.1.8 and earlier
IBM Streams	4.2.1.6 and earlier
IBM Streams	4.3.0.2 and earlier

Remediation/Fixes

NOTE: Fix Packs are available on IBM Fix Central.

To remediate/fix this issue, follow the instructions below:

Version 4.3.x: Apply _ 4.3.0 Fix Pack 1 (4.3.0.3) or higher_ .
Version 4.2.x: Apply 4.2.1 Fix Pack 4 (4.2.1.7) or higher .
Version 4.1.x: Apply 4.1.1 Fix Pack 6 (4.1.1.9) or higher .
Version 4.0.x: Apply 4.0.1 Fix Pack 6 (4.0.1.6) or higher .
Versions 3.2.x, 3.1.x, and 3.0.x: For versions earlier than 4.x.x, IBM recommends upgrading to a fixed, supported version/release/platform of the product. Customers who cannot upgrade and need to secure their installation should open a PMR with IBM Technical Support and request assistance securing their InfoSphere Streams system against the vulnerabilities identified in this Security Bulletin.