Security Bulletin: Vulnerability in Google Guava affects WebSphere Service Registry and Repository (CVE-2018-10237)

Summary

A vulnerability in Google Guava affects WebSphere Service Registry and Repository. This issue is also addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository.

Vulnerability Details

CVEID:CVE-2018-10237
**DESCRIPTION:**Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArray and CompoundOrdering class. By sending a specially-crafted data, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/142508 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Principal Product and Version

|

Affected Supporting Product and Version

—|—

WebSphere Service Registry and Repository V8.5

|

WebSphere Application Server V8.5.5

Remediation/Fixes

For WebSphere Service Registry and Repository this issue is addressed by preventing the problem classes from being deserialized. Perform the following steps to achieve this:

• Edit the WebSphere Application Server JVM properties in the Integrated Solutions Console for each of the affected server instances
• Navigate to Servers > Server Types > WebSphere application servers > <SERVER_NAME> > Java and Process Management > Process definition > Java Virtual Machine > Generic JVM arguments
• Append the following to the JVM arguments:

-Djdk.serialFilter=!com.google.common.util.concurrent.AtomicDoubleArray;!com.google.common.collect.CompoundOrdering_CustomFieldSerializer

• Resynchronize and restart the WebSphere Application Server environment

For WebSphere Application Server refer to the following security bulletin:

Security Bulletin: Potential denial of service in WebSphere Application Server (CVE-2018-10237)

Workarounds and Mitigations

None