Incorrect default permissions in Guava: Google Core Libraries For Java - CVE-2020-8908

Vulnerability identifier: #VU50139

CSH Severity: Low

CVSS v4 BT: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-8908

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files located in the temporary directory set by the Guava com.google.common.io.Files.createTempDir(). A local user with access to the system can view contents of files and directories or modify them.

Guava: Google Core Libraries For Java
IBM Integration Bus
IBM Cloud Transformation Advisor
IBM Process Mining
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling Partner Engagement Manager
Netcool Operations Insight
Financial Transaction Manager for ACH Services and Check Services
IBM Cloud Application Performance Management (APM)
IBM Spectrum Protect Storage Agent
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Proxy Module
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Server Module
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
openSUSE Leap
openEuler
Fedora
IBM i Modernization Engine for Lifecycle Integration
DataStax Hyper-Converged Database
DataStage on Cloud Pak for Data
Oracle Data Integrator
Multi-Enterprise Integration Gateway
B2B Advanced Communications
ObjectScale
IBM Security Risk Manager
IBM Planning Analytics Workspace
PowerStore T
Dell EMC PowerStore Family Operating System
User Entity Behavior Analytics
Synthetic Playback Agent
Storage Virtualize
Maximo Application Suite - IoT Component
IBM Engineering Systems Design Rhapsody
webMethods Integration Server
Robotic Process Automation for Cloud Pak
Oracle Communications Cloud Native Core Unified Data Repository
Apache Pulsar
Voice Gateway
Cloudera Data Platform Private Cloud Base for IBM
JBoss Enterprise Application Platform
Oracle WebLogic Server
AMQ Broker
IBM Qradar SIEM
Jazz Reporting Service
Splunk Enterprise
PeopleSoft Enterprise PeopleTools
Operational Decision Manager
JD Edwards EnterpriseOne Orchestrator
IBM Security Guardium
Oracle Commerce Guided Search
Oracle Communications BRM - Elastic Charging Engine
Oracle NoSQL Database
IBM InfoSphere Information Server
Oracle Communications Pricing Design Center
Primavera Unifier
IBM Disconnected Log Collector
plexus-build-api
sisu
sisu-mojos
java_cup
maven-artifact-transfer
subscription-matcher
atinject
plexus-languages
munge-maven-plugin
virtual-host-gatherer-libcloud
virtual-host-gatherer-Kubernetes
virtual-host-gatherer-VMware
virtual-host-gatherer-Nutanix
virtual-host-gatherer
plexus-resources
apiguardian
jdom
maven-shared-incremental
opentest4j
apache-commons-logging
jakarta-annotations
apache-commons-jxpath
apache-commons-cli
plexus-sec-dispatcher
maven-resolver
maven-remote-resources-plugin
jflex
plexus-cipher
slf4j
velocity
xz-java
apache-commons-beanutils
byte-buddy
maven-dependency-analyzer
modello
felix-utils
fusesource-pom
jsoup
apache-commons-codec
apache-commons-compress
plexus-interpolation
beust-jcommander
qdox
cdi-api
jdom2
plexus-containers
jansi
hamcrest
plexus-classworlds
apache-commons-io
xmlunit
plexus-compiler
univocity-parsers
maven-enforcer
maven-surefire
maven-antrun-plugin
maven-shared-io
maven-file-management
maven-dependency-tree
jsr-305
jsr-305-javadoc
maven-common-artifact-filters
maven-dependency-plugin
cobbler
objenesis
maven-filtering
maven-resources-plugin
maven-plugin-build-helper
maven-jar-plugin
plexus-io
maven-source-plugin
apache-commons-collections
cglib
maven-assembly-plugin
plexus-utils
maven-plugin-testing
maven-shared-utils
maven-wagon
maven-archiver
maven-plugin-tools
maven
mockito
maven-compiler-plugin
apache-commons-lang3
assertj-core
xmvn
easymock
google-guice
plexus-archiver
susemanager-tftpsync
supportutils-plugin-susemanager
mgr-libmod
python3-uyuni-common-libs
spacewalk-search
mgr-daemon
spacewalk-proxy-common
spacewalk-proxy-salt
spacewalk-proxy-management
spacewalk-proxy-redirect
spacewalk-proxy-package-manager
spacewalk-proxy-broker
spacecmd
spacewalk-client-tools
python3-spacewalk-client-setup
spacewalk-check
spacewalk-client-setup
python3-spacewalk-check
python3-spacewalk-client-tools
spacewalk-backend-package-push-server
spacewalk-backend-xmlrpc
spacewalk-backend-app
spacewalk-backend
spacewalk-backend-sql-postgresql
spacewalk-backend-iss-export
spacewalk-backend-sql
spacewalk-backend-applet
spacewalk-backend-config-files-common
spacewalk-backend-tools
spacewalk-backend-server
spacewalk-backend-iss
spacewalk-backend-xml-export-libs
spacewalk-backend-config-files
spacewalk-backend-config-files-tool
susemanager-sls
uyuni-config-modules
spacewalk-base
spacewalk-base-minimal-config
spacewalk-base-minimal
spacewalk-html
spacewalk-java
spacewalk-java-lib
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
httpcomponents-core
httpcomponents-client
junit
xbean
jakarta-servlet
maven-plugin-bundle
aqute-bnd
junit5
javapackages-tools
plexus-components-pom
osgi-compendium
plexus-pom
testng
felix-parent
osgi-core
osgi-annotation
objectweb-asm
httpcomponents-project
susemanager-build-keys-web
susemanager-build-keys
apache-parent
guava
guava-help
guava-testlib
apache-resource-bundles
guava-javadoc
maven-parent
apache-commons-parent
mojo-parent
watsonx.data
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
Red Hat Single Sign-On
IBM App Connect Enterprise

Install updates from vendor's website.

Guava: Google Core Libraries For Java - update to 32.0.0
IBM i Modernization Engine for Lifecycle Integration - update to 1.0.1
DataStax Hyper-Converged Database - update to 1.2.5
Apache Pulsar - update to 2.8.0
IBM Cloud Transformation Advisor - update to 3.2.0
IBM Process Mining - update to 2.1.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.8
DataStage on Cloud Pak for Data - update to 4.8.5
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
JBoss Enterprise Application Platform - update to 7.3.6
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 9, 7.4.3 Fix Pack 1, 7.5.0 Update Pack 9
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.0.9, 9.1.1, 9.1.4, 9.2.1
JD Edwards EnterpriseOne Orchestrator - update to 9.2.7.3
Oracle NoSQL Database - update to 20.3
plexus-build-api - update to 0.0.7-32.fc35
sisu - update to 0.3.4-5.fc35
sisu-mojos - update to 0.3.4-7.fc35
java_cup - update to 0.11b-17.fc35
maven-artifact-transfer - update to 0.13.1-2.fc35
subscription-matcher - update to 0.29-150300.6.15.5
Multi-Enterprise Integration Gateway - update to 1.0.0.8
B2B Advanced Communications - update to 1.0.0.8
atinject - update to 1.0.3-2.fc35
plexus-languages - update to 1.0.6-2.fc35
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
munge-maven-plugin - update to 1.0-20.fc35
virtual-host-gatherer-libcloud - update to 1.0.25-150300.3.12.5
virtual-host-gatherer-Kubernetes - update to 1.0.25-150300.3.12.5
virtual-host-gatherer-VMware - update to 1.0.25-150300.3.12.5
virtual-host-gatherer-Nutanix - update to 1.0.25-150300.3.12.5
virtual-host-gatherer - update to 1.0.25-150300.3.12.5
plexus-resources - update to 1.1.0-6.fc35
apiguardian - update to 1.1.1-2.fc35
jdom - update to 1.1.3-25.fc35
maven-shared-incremental - update to 1.1-22.fc35
opentest4j - update to 1.2.0-6.fc35
apache-commons-logging - update to 1.2-26.fc35
jakarta-annotations - update to 1.3.5-8.fc35
apache-commons-jxpath - update to 1.3-39.fc35
ObjectScale - update to 1.4.0
apache-commons-cli - update to 1.4-13.fc35
plexus-sec-dispatcher - update to 1.4-33.fc35
IBM Disconnected Log Collector - update to 1.6
maven-resolver - update to 1.6.1-2.fc35
Netcool Operations Insight - update to 1.6.11
maven-remote-resources-plugin - update to 1.7.0-5.fc35
jflex - update to 1.7.0-6.fc35
plexus-cipher - update to 1.7-23.fc35
slf4j - update to 1.7.30-9.fc35
velocity - update to 1.7-35.fc35
IBM Security Risk Manager - update to 1.8.0.0
xz-java - update to 1.8-11.fc35
apache-commons-beanutils - update to 1.9.4-6.fc35
byte-buddy - update to 1.10.20-2.fc35
maven-dependency-analyzer - update to 1.11.3-3.fc35
modello - update to 1.11-5.fc35
felix-utils - update to 1.11.6-2.fc35
fusesource-pom - update to 1.12-7.fc35
jsoup - update to 1.13.1-6.fc35
apache-commons-codec - update to 1.15-3.fc35
apache-commons-compress - update to 1.20-6.fc35
plexus-interpolation - update to 1.26-7.fc35
beust-jcommander - update to 1.78-6.fc35
qdox - update to 2.0.0-5.fc35
cdi-api - update to 2.0.2-2.fc35
watsonx.data - update to 2.0.3
jdom2 - update to 2.0.6-22.fc35
IBM Planning Analytics Workspace - update to 2.0.91
plexus-containers - update to 2.1.0-6.fc35
jansi - update to 2.1.1-4.fc35
hamcrest - update to 2.2-3.fc35
plexus-classworlds - update to 2.6.0-7.fc35
apache-commons-io - update to 2.8.0-4.fc35
xmlunit - update to 2.8.2-2.fc35
plexus-compiler - update to 2.8.8-2.fc35
univocity-parsers - update to 2.9.1-2.fc35
maven-enforcer - update to 3.0.0~M3-5.fc35
maven-surefire - update to 3.0.0~M4-2.fc35
maven-antrun-plugin - update to 3.0.0-2.fc35
maven-shared-io - update to 3.0.0-13.fc35
maven-file-management - update to 3.0.0-13.fc35
maven-dependency-tree - update to 3.0.1-7.fc35
jsr-305 - update to 3.0.2-2.fc35
jsr-305 - update to 3.0.2-150200.3.7.5
jsr-305-javadoc - update to 3.0.2-150200.3.7.5
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
maven-common-artifact-filters - update to 3.1.1-2.fc35
maven-dependency-plugin - update to 3.1.2-6.fc35
cobbler - update to 3.1.2-150300.5.22.5
objenesis - update to 3.1-6.fc35
maven-filtering - update to 3.2.0-2.fc35
maven-resources-plugin - update to 3.2.0-3.fc35
maven-plugin-build-helper - update to 3.2.0-4.fc35
maven-jar-plugin - update to 3.2.0-6.fc35
plexus-io - update to 3.2.0-6.fc35
maven-source-plugin - update to 3.2.1-5.fc35
apache-commons-collections - update to 3.2.2-23.fc35
cglib - update to 3.3.0-3.fc35
maven-assembly-plugin - update to 3.3.0-5.fc35
plexus-utils - update to 3.3.0-6.fc35
maven-plugin-testing - update to 3.3.0-20.fc35
maven-shared-utils - update to 3.3.3-2.fc35
maven-wagon - update to 3.4.2-2.fc35
maven-archiver - update to 3.5.1-2.fc35
maven-plugin-tools - update to 3.6.0-9.fc35
PowerStore T - update to 3.6.1.2-2315284
maven - update to 3.6.3-9.fc35
mockito - update to 3.7.13-2.fc35
maven-compiler-plugin - update to 3.8.1-9.fc35
apache-commons-lang3 - update to 3.12.0-2.fc35
assertj-core - update to 3.19.0-2.fc35
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
xmvn - update to 4.0.0~20191028.da67577-6.fc35
easymock - update to 4.2-3.fc35
google-guice - update to 4.2.3-5.fc35
plexus-archiver - update to 4.2.4-2.fc35
susemanager-tftpsync - update to 4.2.4-150300.3.6.6
supportutils-plugin-susemanager - update to 4.2.6-150300.3.12.5
mgr-libmod - update to 4.2.8-150300.3.9.6
python3-uyuni-common-libs - update to 4.2.10-150300.3.17.6
spacewalk-search - update to 4.2.10-150300.3.18.6
mgr-daemon - update to 4.2.11-150300.2.12.5
spacewalk-proxy-common - update to 4.2.14-150300.3.27.6
spacewalk-proxy-salt - update to 4.2.14-150300.3.27.6
spacewalk-proxy-management - update to 4.2.14-150300.3.27.6
spacewalk-proxy-redirect - update to 4.2.14-150300.3.27.6
spacewalk-proxy-package-manager - update to 4.2.14-150300.3.27.6
spacewalk-proxy-broker - update to 4.2.14-150300.3.27.6
spacecmd - update to 4.2.22-150300.4.36.7
spacewalk-client-tools - update to 4.2.23-150300.4.33.7
python3-spacewalk-client-setup - update to 4.2.23-150300.4.33.7
spacewalk-check - update to 4.2.23-150300.4.33.7
spacewalk-client-setup - update to 4.2.23-150300.4.33.7
python3-spacewalk-check - update to 4.2.23-150300.4.33.7
python3-spacewalk-client-tools - update to 4.2.23-150300.4.33.7
spacewalk-backend-package-push-server - update to 4.2.27-150300.4.38.7
spacewalk-backend-xmlrpc - update to 4.2.27-150300.4.38.7
spacewalk-backend-app - update to 4.2.27-150300.4.38.7
spacewalk-backend - update to 4.2.27-150300.4.38.7
spacewalk-backend-sql-postgresql - update to 4.2.27-150300.4.38.7
spacewalk-backend-iss-export - update to 4.2.27-150300.4.38.7
spacewalk-backend-sql - update to 4.2.27-150300.4.38.7
spacewalk-backend-applet - update to 4.2.27-150300.4.38.7
spacewalk-backend-config-files-common - update to 4.2.27-150300.4.38.7
spacewalk-backend-tools - update to 4.2.27-150300.4.38.7
spacewalk-backend-server - update to 4.2.27-150300.4.38.7
spacewalk-backend-iss - update to 4.2.27-150300.4.38.7
spacewalk-backend-xml-export-libs - update to 4.2.27-150300.4.38.7
spacewalk-backend-config-files - update to 4.2.27-150300.4.38.7
spacewalk-backend-config-files-tool - update to 4.2.27-150300.4.38.7
susemanager-sls - update to 4.2.32-150300.3.46.5
uyuni-config-modules - update to 4.2.32-150300.3.46.5
spacewalk-base - update to 4.2.34-150300.3.41.5
spacewalk-base-minimal-config - update to 4.2.34-150300.3.41.5
spacewalk-base-minimal - update to 4.2.34-150300.3.41.5
spacewalk-html - update to 4.2.34-150300.3.41.5
spacewalk-java - update to 4.2.49-150300.3.63.3
spacewalk-java-lib - update to 4.2.49-150300.3.63.3
spacewalk-taskomatic - update to 4.2.49-150300.3.63.3
spacewalk-java-postgresql - update to 4.2.49-150300.3.63.3
spacewalk-java-config - update to 4.2.49-150300.3.63.3
susemanager-docs_en - update to 4.2-150300.12.42.5
susemanager-docs_en-pdf - update to 4.2-150300.12.42.5
susemanager-doc-indexes - update to 4.2-150300.12.42.6
httpcomponents-core - update to 4.4.13-3.fc35
httpcomponents-client - update to 4.5.11-3.fc35
EMC ViPR SRM - update to 4.10.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
junit - update to 4.13.1-2.fc35
xbean - update to 4.18-2.fc35
jakarta-servlet - update to 5.0.0-6.fc35
User Entity Behavior Analytics - update to 5.0.2
maven-plugin-bundle - update to 5.1.1-2.fc35
aqute-bnd - update to 5.2.0-2.fc35
junit5 - update to 5.7.1-2.fc35
javapackages-tools - update to 6.0.0~alpha-6.fc35
plexus-components-pom - update to 6.5-3.fc35
osgi-compendium - update to 7.0.0-9.fc35
Jazz Reporting Service - update to 7.0.2 iFix022
plexus-pom - update to 7-2.fc35
testng - update to 7.3.0-2.fc35
Red Hat Single Sign-On - update to 7.4.6
felix-parent - update to 7-5.fc35
AMQ Broker - update to 7.8.1
osgi-core - update to 8.0.0-2.fc35
osgi-annotation - update to 8.0.0-2.fc35
Synthetic Playback Agent - update to 8.1.4 IF18
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
IBM Spectrum Protect Storage Agent - update to 8.1.19
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
objectweb-asm - update to 9.1-2.fc35
IBM Security Verify Governance - update to 10.0.1.0.4
webMethods Integration Server - addressed in versions 10.5 Core Fix30, 10.7 Core Fix24, 10.11 Core Fix15, 10.15 Core Fix15, 11.1 Core Fix2
IBM App Connect Enterprise - addressed in versions 11.0.0.21, 12.0.9.0
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
httpcomponents-project - update to 12-3.fc35
susemanager-build-keys-web - update to 15.3.6-150300.3.9.5
susemanager-build-keys - update to 15.3.6-150300.3.9.5
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.12
apache-parent - update to 23-5.fc35
guava - update to 25.0-5
guava-help - update to 25.0-5
guava-testlib - update to 25.0-5
guava - addressed in versions 30.1.1-150300.4.3.4, 32.0.1-150200.3.7.1, 32.0.1-150400.3.3.1
guava - update to 30.1-2.fc35
apache-resource-bundles - update to 30-2.fc35
guava-testlib - update to 32.0.1-150200.3.7.1
guava-javadoc - update to 32.0.1-150200.3.7.1
maven-parent - update to 34-7.fc35
apache-commons-parent - update to 52-3.fc35
mojo-parent - update to 60-2.fc35

• https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40
• https://github.com/google/guava/issues/4011
• https://lists.apache.org/thread.html/r215b3d50f56faeb2f9383505f3e62faa9f549bb23e8a9848b78a968e@%3Ccommits.ws.apache.org%3E
• https://lists.apache.org/thread.html/r4776f62dfae4a0006658542f43034a7fc199350e35a66d4e18164ee6@%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/r68d86f4b06c808204f62bcb254fcb5b0432528ee8d37a07ef4bc8222@%3Ccommits.ws.apache.org%3E
• https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba@%3Cissues.maven.apache.org%3E
• https://lists.apache.org/thread.html/rb8c0f1b7589864396690fe42a91a71dea9412e86eec66dc85bbacaaf@%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
• https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
• https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
• https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415
• https://github.com/google/guava/issues/2575
• https://github.com/google/guava/releases/tag/v32.0.0

• Privilege escalation in Google Guava
• Multiple vulnerabilities in JBoss Enterprise Application Platform
• Multiple vulnerabilities in Oracle NoSQL Database
• Multiple vulnerabilities in Apache Pulsar
• Multiple vulnerabilities in Oracle Data Integrator
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Security Risk Manager on CP4S
• Multiple vulnerabilities in IBM Security Guardium
• Incorrect default permissions in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Voice Gateway
• Incorrect default permissions in IBM B2B Advanced Communications
• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in APM Synthetic Playback Agent
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Data Integrator
• Multiple vulnerabilities in Oracle WebLogic Server
• SUSE update for guava
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Incorrect default permissions in IBM Jazz Reporting Services
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• SUSE update for Maintenance update for SUSE Manager 4.2: Server, Proxy and Retail Branch Server
• openEuler 20.03 LTS SP1 update for guava
• SUSE update for guava
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in Dell PowerStore Family
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in Dell PowerStoreT OS
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM watsonx.data update for FasterXML jackson-databind
• IBM watsonx.data update for Logback, Guava and Apache HTTPClient
• IBM watsonx.data update for Google Guava
• Multiple vulnerabilities in AMQ Broker 7.8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.4
• Fedora 35 update for apache-commons-beanutils, apache-commons-cli, apache-commons-codec, apache-commons-collections, apache-commons-compress, apache-commons-io, apache-commons-jxpath, apache-commons-lang3, apache-commons-logging, apache-commons-parent, ap
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in IBM webMethods Integration Server
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform
• Multiple vulnerabilities in IBM DataStax Hyper-Converged Database