[QPID-8485] Upgrade guava version to latest

• Type: Task
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: qpid-java-broker-8.0.3
• Component/s: Broker-J
• Assignee: Unassigned
• Reporter: Dedeepya
• Created: 06/Nov/20 09:56
• Updated: 16/Jan/21 17:18
• Resolved: 30/Nov/20 09:11

Description

Security vulnerabilities are reported with the guava version below 28.2-jre.

This package are vulnerable to Information Disclosure. The file permissions on the file created by com.google.common.io.Files.createTempDir allows an attacker running a malicious program co-resident on the same machine can steal secrets stored in this directory. This is because by default on unix-like operating systems the /temp directory is shared between all users, so if the correct file permissions aren't set by the directory/file creator, the file becomes readable by all other users on that system.

https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415

The Qpid Broker does not utilize the impacted functionality. Thus, it is not vulnerable to the reported issue. Though, we need to upgrade the guava version in order to stop from being flagged by scanning tools