Security Bulletin
Summary
A vulnerability in Google Guava affects WebSphere Service Registry and Repository. This issue is also addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository.
Vulnerability Details
CVEID: CVE-2018-10237
DESCRIPTION: Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArray and CompoundOrdering class. By sending a specially-crafted data, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/142508 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
|
Affected Principal Product and Version
|
Affected Supporting Product and Version
|
|
WebSphere Service Registry and Repository V8.5
|
WebSphere Application Server V8.5.5
|
Remediation/Fixes
For WebSphere Service Registry and Repository this issue is addressed by preventing the problem classes from being deserialized. Perform the following steps to achieve this:
- Edit the WebSphere Application Server JVM properties in the Integrated Solutions Console for each of the affected server instances
- Navigate to Servers > Server Types > WebSphere application servers > <SERVER_NAME> > Java and Process Management > Process definition > Java Virtual Machine > Generic JVM arguments
- Append the following to the JVM arguments:
-Djdk.serialFilter=!com.google.common.util.concurrent.AtomicDoubleArray;!com.google.common.collect.CompoundOrdering_CustomFieldSerializer
- Resynchronize and restart the WebSphere Application Server environment
For WebSphere Application Server refer to the following security bulletin:
Security Bulletin: Potential denial of service in WebSphere Application Server (CVE-2018-10237)
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
Change History
18 Jan 2021: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
18 January 2021
UID
ibm16404298