| Package | Affected versions | Patched versions |
|---|---|---|
| com.google.guava:guava | < 32.0.0-android | 32.0.0-android |
| guava | < 32.0.0 | 32.0.0 |
| commerce guided search | = 11.3.2 | |
| communications cloud native core network repository function | = 1.14.0 | |
| communications cloud native core network slice selection function | = 1.2.1 | |
| communications pricing design center | = 12.0.0.4.0= 12.0.0.5.0 | |
| data integrator | = 12.2.1.3.0= 12.2.1.4.0 | |
| nosql database | < 20.3 | 20.3 |
| peoplesoft enterprise peopletools | = 8.57= 8.58= 8.59 | |
| primavera unifier | = 18.8= 19.12= 20.12= 21.12≥ 17.7, ≤ 17.12 | |
| retail customer management and segmentation foundation | ≥ 16.0, ≤ 19.0 | |
| weblogic server | = 14.1.1.0.0 | |
| quarkus | < 1.11.4 | 1.11.4 |
A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free