[QPID-8256] [Broker-J] Update Guava to version 27.0

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: qpid-java-broker-7.1.0, qpid-java-broker-7.0.7
• Component/s: Broker-J
• Assignee: Alex Rudyy
• Reporter: Alex Rudyy
• Created: 02/Nov/18 11:35
• Updated: 16/Mar/20 08:48
• Resolved: 07/Dec/18 10:02

Description

The Qpid Broker depends on an older guava version 0.22 which is affected by vulnerability CVE-2018-10237. It does not look like vulnerability CVE-2018-10237 can be exploited with Qpid Broker, as impacted guava classes AtomicDoubleArray and CompoundOrdering are not used directly or indirectly within Qpid Broker code.