[GHSA-7g45-4rm6-3mm3] Guava vulnerable to insecure use of temporary directory

[virangdoshi]

Updates

• Affected products

Comments
Added a variation of the package to the affected product

[virangdoshi]

https://mvnrepository.com/artifact/com.google.guava/guava

[shelbyc]

👋 Hi @virangdoshi, thank you for your contribution, but I can't accept the suggested change because it wouldn't work with current vulnerable version range (VVR) logic. The VVR must use the -android suffix as the patched version because using -jre will lead to -android being incorrectly marked as vulnerable. This happens because -jre occurs later in the alphabet than -android, so -android is interpreted as an earlier version of the same package, not a variant of the same package.

Documentation that describes this vulnerable version range behavior is available at https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/best-practices-for-writing-repository-security-advisories#common-errors.

GHSA-7g45-4rm6-3mm is used as an example of this behavior at https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/best-practices-for-writing-repository-security-advisories#advisory-with-branch-names-in-version-numbers.

Thank you for your interest in GHSA-7g45-4rm6-3mm and have a good week.