Incorrect default permissions in Guava: Google Core Libraries For Java - CVE-2023-2976

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU77107

Incorrect default permissions in Guava: Google Core Libraries For Java - CVE-2023-2976

Published: June 8, 2023 / Updated: November 22, 2023


Vulnerability identifier: #VU77107
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-2976
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions in com.google.common.io.FileBackedOutputStream. A local user with access to the system can view contents of files and directories or modify them.


Affected software

Guava: Google Core Libraries For Java
Amazon Linux AMI
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Oracle Solaris Cluster
SUSE Manager Server
SUSE Manager Server Module
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Development Tools Module
openSUSE Leap
openEuler
IBM Business Automation Workflow
IBM Integration Bus
IT Service Intelligence (ITSI)
Jira Service Management Data Center
Jira Service Management Server
Splunk User Behavior Analytics (UBA)
IBM Sterling Partner Engagement Manager
Jira Software Data Center
Oracle Financial Services Behavior Detection Platform
Oracle Healthcare Data Repository
Oracle Communications Diameter Signaling Router
Oracle Communications Session Report Manager
IBM Workload Scheduler
Oracle Identity Manager Connector
Oracle Banking Collections and Recovery
Oracle Banking Enterprise Default Management
Oracle Banking Party Management
Oracle Banking APIs
Primavera P6 Enterprise Project Portfolio Management
Oracle Blockchain Platform
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Exposure Function
Log Analysis
Netcool Operations Insight
IBM Process Mining
IBM Spectrum Conductor
Red Hat build of Quarkus
Financial Transaction Manager for ACH Services and Check Services
IBM Cloud Transformation Advisor
Unified Mediation Bus
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Control
IBM Sterling Secure Proxy
Red Hat Migration Toolkit for Applications
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Security Verify Governance
IBM InfoSphere Information Server for Cloud
IBM Cloud Pak for Business Automation
Autodesk Infraworks
DataStax Hyper-Converged Database
Oracle Utilities Network Management System
Tivoli Network Manager IP Edition
Dell Policy Manager for Secure Connect Gateway (SCG)
Oracle Business Intelligence Enterprise Edition
Oracle Financial Services Analytical Applications Infrastructure
IBM Business Automation Manager Open Editions
Datacap
webMethods API Gateway
Oracle Data Integrator
Oracle Communications Policy Management
Oracle Financial Services Lending and Leasing
Oracle FLEXCUBE Investor Servicing
Oracle Banking Digital Experience
Oracle Retail Xstore Point of Service
IBM Watson Machine Learning Accelerator
ObjectScale
IBM i Modernization Engine for Lifecycle Integration
IBM Planning Analytics Workspace
Cloud Pak for Network Automation
PowerStore T
Dell EMC PowerStore Family Operating System
User Entity Behavior Analytics
Maximo Application Suite - IoT Component
IBM Engineering Systems Design Rhapsody
webMethods Integration Server
InfoSphere Data Replication
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
QRadar Suite
Juniper Secure Analytics (JSA)
Splunk Enterprise
IBM Data Risk Manager
Oracle Communications Element Manager
Oracle Fusion Middleware MapViewer
Oracle WebCenter Sites
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle Business Process Management Suite
Oracle Managed File Transfer
Oracle Banking Trade Finance Process Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Liquidity Management
Oracle Banking Supply Chain Finance
Oracle Banking Corporate Lending Process Management
Oracle Banking Origination
Oracle Banking Cash Management
Oracle Banking Branch
Oracle Banking Virtual Account Management
Siebel Apps - Public Sector
AMQ Streams
AMQ Broker
JBoss Enterprise Application Platform
Oracle WebLogic Server
Primavera Gateway
Oracle Communications Convergence
Communications Service Catalog and Design
Oracle Communications Instant Messaging Server
Oracle Communications Offline Mediation Controller
Voice Gateway
OpenShift Developer Tools and Services
Oracle Agile PLM Framework
Oracle JDeveloper
GraphQL Java
Red Hat Camel for Spring Boot
Jazz Foundation
IBM App Connect Enterprise
IBM Qradar SIEM
Jira Software Server
Jazz Reporting Service
Red Hat Single Sign-On
MySQL Enterprise Monitor
IBM InfoSphere Information Server
Oracle Healthcare Foundation
PeopleSoft Enterprise PeopleTools
Oracle Fusion Middleware
Oracle Documaker
Operational Decision Manager
JD Edwards EnterpriseOne Tools
Primavera Unifier
IBM Disconnected Log Collector
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Banking Payments
Oracle Retail Financial Integration
Oracle Retail Customer Management and Segmentation Foundation
IBM Security Guardium
Oracle FLEXCUBE Enterprise Limits and Collateral Management
Oracle Banking Corporate Lending
RSA Authentication Manager
Oracle Retail Integration Bus
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Security Edge Protection Proxy
eap7-jboss-jsp (Red Hat package)
eap7-yasson (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-avro (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-activemq-artemis (Red Hat package)
jenkins (Red Hat package)
eap7-weld-core (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-jgroups (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
rh-sso7-keycloak (Red Hat package)
guava20
guava20-help
guava-help
guava-testlib
guava
guava-javadoc
eap7-guava-libraries (Red Hat package)
OpenView Performance Manager (OVPM)
watsonx.data

How to mitigate CVE-2023-2976

Install updates from vendor's website.

Guava: Google Core Libraries For Java - update to 32.0.0
DataStax Hyper-Converged Database - update to 1.2.5
QRadar Suite - update to 1.10.18.0
IBM Data Risk Manager - update to 2.0.6.18
AMQ Streams - addressed in versions 2.5.0, 2.6.0, 2.7.0
Tivoli Network Manager IP Edition - update to 4.2.0.20
IT Service Intelligence (ITSI) - addressed in versions 4.13.3, 4.15.3
Jira Service Management Data Center - addressed in versions 5.12.4, 5.13.1
Jira Service Management Server - addressed in versions 5.12.4, 5.13.1
Splunk User Behavior Analytics (UBA) - addressed in versions 5.2.1, 5.3.0
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.18.00.00
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
AMQ Broker - update to 7.11.2
JBoss Enterprise Application Platform - update to 7.4.14
IBM Qradar SIEM - addressed in versions 7.5.0 Update Pack 7, 7.5.0 Update Pack 9
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF04
Red Hat Single Sign-On - update to 7.6.7
Jira Software Data Center - addressed in versions 8.20.28, 9.4.12, 9.11.3
Jira Software Server - addressed in versions 8.20.28, 9.4.12, 9.11.3
Splunk Enterprise - addressed in versions 9.0.9, 9.1.4, 9.2.1
IBM Business Automation Manager Open Editions - update to 9.0.1
Datacap - update to 9.1.10
JD Edwards EnterpriseOne Tools - update to 9.2.9.0
IBM Workload Scheduler - update to 10.2.0.1
webMethods API Gateway - update to 10.15 Fix 10
Oracle FLEXCUBE Enterprise Limits and Collateral Management - update to 14.4
Oracle Banking Corporate Lending - update to 14.4
Oracle Banking Payments - update to 14.3.0
Oracle Financial Services Lending and Leasing - update to 14.8.0
GraphQL Java - update to 18.7
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el9eap
OpenView Performance Manager (OVPM) - update to T0684V01^ABL
Voice Gateway - addressed in versions 1.0.8.6, 1.0.8.9
eap7-yasson (Red Hat package) - addressed in versions 1.0.11-4.redhat_00002.1.el7eap, 1.0.11-4.redhat_00002.1.el8eap, 1.0.11-4.redhat_00002.1.el9eap
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.16-1.Final_redhat_00001.1.el7eap, 1.1.16-1.Final_redhat_00001.1.el8eap, 1.1.16-1.Final_redhat_00001.1.el9eap
IBM Watson Machine Learning Accelerator - update to 1.2.3 601632-wmla
Log Analysis - update to 1.3.8 Fix Pack 1
ObjectScale - update to 1.4.0
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.4
Netcool Operations Insight - update to 1.6.12
IBM Disconnected Log Collector - update to 1.8.4
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-33.Final_redhat_00032.1.el7eap, 1.10.0-33.Final_redhat_00032.1.el8eap, 1.10.0-33.Final_redhat_00032.1.el9eap
eap7-avro (Red Hat package) - addressed in versions 1.11.3-1.redhat_00001.1.el7eap, 1.11.3-1.redhat_00001.1.el8eap, 1.11.3-1.redhat_00001.1.el9eap
IBM Process Mining - update to 1.14.2
watsonx.data - update to 2.0.3
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.14-1.SP1_redhat_00001.1.el7eap, 2.0.14-1.SP1_redhat_00001.1.el8eap, 2.0.14-1.SP1_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.0.91
eap7-undertow (Red Hat package) - addressed in versions 2.2.28-1.SP1_redhat_00001.1.el7eap, 2.2.28-1.SP1_redhat_00001.1.el8eap, 2.2.28-1.SP1_redhat_00001.1.el9eap
eap7-jandex (Red Hat package) - addressed in versions 2.4.4-1.Final_redhat_00001.1.el7eap, 2.4.4-1.Final_redhat_00001.1.el8eap, 2.4.4-1.Final_redhat_00001.1.el9eap
IBM Spectrum Conductor - update to 2.5.1 FP2
Cloud Pak for Network Automation - update to 2.6.0
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.3-1.redhat_00001.1.el7eap, 2.9.3-1.redhat_00001.1.el8eap, 2.9.3-1.redhat_00001.1.el9eap
Red Hat build of Quarkus - update to 2.13.9
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-17.redhat_00051.1.el7eap, 2.16.0-17.redhat_00051.1.el8eap, 2.16.0-17.redhat_00051.1.el9eap
jenkins (Red Hat package) - addressed in versions 2.426.3.1706515686-3.el8, 2.426.3.1706516352-3.el8
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
eap7-weld-core (Red Hat package) - addressed in versions 3.1.10-2.Final_redhat_00001.1.el7eap, 3.1.10-2.Final_redhat_00001.1.el8eap, 3.1.10-2.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.20-1.Final_redhat_00001.1.el7eap, 3.3.20-1.Final_redhat_00001.1.el8eap, 3.3.20-1.Final_redhat_00001.1.el9eap
PowerStore T - update to 3.6.1.2-2315284
IBM Cloud Transformation Advisor - update to 3.7.0
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.11-1.SP1_redhat_00001.1.el7eap, 3.8.11-1.SP1_redhat_00001.1.el8eap, 3.8.11-1.SP1_redhat_00001.1.el9eap
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
eap7-jgroups (Red Hat package) - addressed in versions 4.2.23-1.Final_redhat_00001.1.el7eap, 4.2.23-1.Final_redhat_00001.1.el8eap, 4.2.23-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - update to 4.4.0
Unified Mediation Bus - update to 4.4
IBM Decision Optimization for Cloud Pak for Data - update to 4.7.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7.3
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.6, 5.0.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
jenkins-2-plugins (Red Hat package) - addressed in versions 4.12.1706515741-1.el8, 4.14.1706516441-1.el8
User Entity Behavior Analytics - update to 5.0.2
App Connect Enterprise Certified Container - addressed in versions 5.0.9, 9.1.0
eap7-hibernate (Red Hat package) - addressed in versions 5.3.32-1.Final_redhat_00001.1.el7eap, 5.3.32-1.Final_redhat_00001.1.el8eap, 5.3.32-1.Final_redhat_00001.1.el9eap
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.9-1.Final_redhat_00001.1.el7eap, 5.4.9-1.Final_redhat_00001.1.el8eap, 5.4.9-1.Final_redhat_00001.1.el9eap
IBM Spectrum Control - update to 5.4.12
IBM Sterling Secure Proxy - addressed in versions 6.0.3 iFix 11, 6.1.0 iFix 03
Red Hat Migration Toolkit for Applications - update to 6.2
Jazz Reporting Service - update to 7.0.2 iFix022
Jazz Foundation - addressed in versions 7.0.2.0.29, 7.0.3.0.2
IBM Tivoli Netcool Impact - update to 7.1.0.31
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
eap7-wildfly (Red Hat package) - addressed in versions 7.4.14-5.GA_redhat_00002.1.el7eap, 7.4.14-5.GA_redhat_00002.1.el8eap, 7.4.14-5.GA_redhat_00002.1.el9eap
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
RSA Authentication Manager - update to 8.7 SP2 Patch 2
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 39, 8.11.0.1 Interim fix 21, 8.11.1 Interim fix 9, 8.12.0 Interim fix 1
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
IBM Security Verify Governance - update to 10.0.2.0.1
webMethods Integration Server - addressed in versions 10.5 Core Fix30, 10.7 Core Fix24, 10.11 Core Fix15, 10.15 Core Fix15, 11.1 Core Fix2
IBM App Connect Enterprise - addressed in versions 11.0.0.21, 11.0.0.22, 12.0.9.0
eap7-infinispan (Red Hat package) - addressed in versions 11.0.18-1.Final_redhat_00001.1.el7eap, 11.0.18-1.Final_redhat_00001.1.el8eap, 11.0.18-1.Final_redhat_00001.1.el9eap
InfoSphere Data Replication - update to 11.4.0.5 11178
IBM InfoSphere Information Server for Cloud - update to 11.7.1.4 Service pack 1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.12-1.redhat_00001.1.el7sso, 18.0.12-1.redhat_00001.1.el8sso, 18.0.12-1.redhat_00001.1.el9sso
Dell Data Protection Central - update to 19.10.0-4
guava20 - update to 20.0-11
guava20-help - update to 20.0-11
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.25, 23.0.1.3
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.12
guava-help - update to 25.0-6
guava-testlib - update to 25.0-6
guava - update to 25.0-6
guava - update to 31.0.1-3
guava-javadoc - update to 32.0.1-150200.3.7.1
guava-testlib - update to 32.0.1-150200.3.7.1
guava - addressed in versions 32.0.1-150200.3.7.1, 32.0.1-150400.3.3.1
eap7-guava-libraries (Red Hat package) - addressed in versions 32.1.1-2.jre_redhat_00001.1.el7eap, 32.1.1-2.jre_redhat_00001.1.el8eap, 32.1.1-2.jre_redhat_00001.1.el9eap
Autodesk Infraworks - addressed in versions 2022.1.10.363, 2023.1.5.251, 2024.1.4.152, 2025.02.86

External References

Related Security Bulletins