CVE-2018-10237
Medium
Description
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Google Guava
PublishedApr 26, 2018
First seenApr 26, 2018
How to fix
Update
- google guava24.1.1 or later
- com.google.guava:guava24.1.1-android or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:2428
- access.redhat.com/errata/RHSA-2018:2740
- access.redhat.com/errata/RHSA-2018:2741
- access.redhat.com/errata/RHSA-2018:2742
- access.redhat.com/errata/RHSA-2018:2598
- access.redhat.com/errata/RHSA-2018:2643
- access.redhat.com/errata/RHSA-2018:2424
- access.redhat.com/errata/RHSA-2018:2423
- access.redhat.com/errata/RHSA-2018:2425
- access.redhat.com/errata/RHSA-2018:2927
- access.redhat.com/errata/RHSA-2018:2743
- access.redhat.com/errata/RHSA-2019:2858
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google guava | 11.0 ≤ v < 24.1.1 | 24.1.1 |
| redhat openshift_container_platform | 3.11, 4.1 | — |
| redhat openstack | 13 | — |
| redhat satellite | 6.4 | — |
| redhat satellite_capsule | 6.4 | — |
| redhat virtualization | 4.2, 4.0 | — |
| redhat virtualization_host | 4.0 | — |
| redhat jboss_enterprise_application_platform | 6.0.0, 6.4.0, 7.1.0 | — |
| oracle banking_payments | 14.1.0 ≤ v ≤ 14.4.0 | — |
| oracle communications_ip_service_activator | 7.3.0, 7.4.0 | — |
| oracle customer_management_and_segmentation_foundation | 18.0 | — |
| oracle database_server | 12.2.0.1, 18c, 19c | — |
| oracle flexcube_investor_servicing | 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle retail_integration_bus | 15.0, 16.0 | — |
| oracle retail_xstore_point_of_service | 7.1, 15.0, 16.0, 17.0 | — |
| oracle weblogic_server | 12.2.1.3.0 | — |
| com.google.guava:guavaMaven | 11.0 ≤ v < 24.1.1-android | 24.1.1-android |
| com.google.guava:guava-jdk5Maven | v ≤ 17.0 | — |
| com.googlecode.guava-osgi:guava-osgiMaven | v ≤ 11.0.1 | — |
| de.mhus.ports:vaadin-shared-depsMaven | v ≤ 7.4.0 | — |
| org.hudsonci.lib.guava:guavaMaven | v ≤ 14.0.1-h-3 | — |
| org.sonatype.sisu:sisu-guavaMaven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.