CVE-2018-10237 Denial of Service in Google Guava
MediumCVSS 5.9
EPSS 8.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.google.guava/guava-jdk5(Maven) | <= 17.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | <= 11.0.1 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | <= 7.4.0 | No fix listed |
| org.hudsonci.lib.guava/guava(Maven) | <= 14.0.1-h-3 | No fix listed |
| org.sonatype.sisu/sisu-guava(Maven) | = 0.11.1 | No fix listed |
| com.google.guava/guava(Maven) | >= 11.0, < 24.1.1-android | 24.1.1-android |
| com.google.guava/guava(Maven) | = 11.0 | No fix listed |
| com.google.guava/guava(Maven) | = 11.0.1 | No fix listed |
| com.google.guava/guava(Maven) | = 11.0.2 | No fix listed |
| com.google.guava/guava(Maven) | = 12.0 | No fix listed |
| com.google.guava/guava(Maven) | = 12.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 12.0-rc2 | No fix listed |
| com.google.guava/guava(Maven) | = 12.0.1 | No fix listed |
| com.google.guava/guava(Maven) | = 13.0 | No fix listed |
| com.google.guava/guava(Maven) | = 13.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 13.0-rc2 | No fix listed |
| com.google.guava/guava(Maven) | = 13.0.1 | No fix listed |
| com.google.guava/guava(Maven) | = 14.0 | No fix listed |
| com.google.guava/guava(Maven) | = 14.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 14.0-rc2 | No fix listed |
| com.google.guava/guava(Maven) | = 14.0-rc3 | No fix listed |
| com.google.guava/guava(Maven) | = 14.0.1 | No fix listed |
| com.google.guava/guava(Maven) | = 15.0 | No fix listed |
| com.google.guava/guava(Maven) | = 15.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 16.0 | No fix listed |
Show 112 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.google.guava/guava(Maven) | = 16.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 16.0.1 | No fix listed |
| com.google.guava/guava(Maven) | = 17.0 | No fix listed |
| com.google.guava/guava(Maven) | = 17.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 17.0-rc2 | No fix listed |
| com.google.guava/guava(Maven) | = 18.0 | No fix listed |
| com.google.guava/guava(Maven) | = 18.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 18.0-rc2 | No fix listed |
| com.google.guava/guava(Maven) | = 19.0 | No fix listed |
| com.google.guava/guava(Maven) | = 19.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 19.0-rc2 | No fix listed |
| com.google.guava/guava(Maven) | = 19.0-rc3 | No fix listed |
| com.google.guava/guava(Maven) | = 20.0 | No fix listed |
| com.google.guava/guava(Maven) | = 20.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 21.0 | No fix listed |
| com.google.guava/guava(Maven) | = 21.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 21.0-rc2 | No fix listed |
| com.google.guava/guava(Maven) | = 22.0 | No fix listed |
| com.google.guava/guava(Maven) | = 22.0-android | No fix listed |
| com.google.guava/guava(Maven) | = 22.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 22.0-rc1-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.0 | No fix listed |
| com.google.guava/guava(Maven) | = 23.0-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.0-rc1 | No fix listed |
| com.google.guava/guava(Maven) | = 23.0-rc1-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.1-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.1-jre | No fix listed |
| com.google.guava/guava(Maven) | = 23.2-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.2-jre | No fix listed |
| com.google.guava/guava(Maven) | = 23.3-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.3-jre | No fix listed |
| com.google.guava/guava(Maven) | = 23.4-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.4-jre | No fix listed |
| com.google.guava/guava(Maven) | = 23.5-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.5-jre | No fix listed |
| com.google.guava/guava(Maven) | = 23.6-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.6-jre | No fix listed |
| com.google.guava/guava(Maven) | = 23.6.1-android | No fix listed |
| com.google.guava/guava(Maven) | = 23.6.1-jre | No fix listed |
| com.google.guava/guava(Maven) | = 24.0-android | No fix listed |
| com.google.guava/guava(Maven) | = 24.0-jre | No fix listed |
| com.google.guava/guava(Maven) | = 24.1-android | No fix listed |
| com.google.guava/guava(Maven) | = 24.1-jre | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 13.0 | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 14.0.1 | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 14.0.1-rc1 | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 16.0 | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 16.0-rc1 | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 17.0 | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 17.0-rc1 | No fix listed |
| com.google.guava/guava-jdk5(Maven) | = 17.0-rc2 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 10.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 10.0.1 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 11.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 11.0.1 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 3.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 4.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 5.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 6.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 7.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 8.0.0 | No fix listed |
| com.googlecode.guava-osgi/guava-osgi(Maven) | = 9.0.0 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 1.3.1 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 1.3.4 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 1.3.6 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 1.3.7 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 1.6.0 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 1.6.1 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 6.2.0 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 7.0.0 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 7.1.0 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 7.2.0 | No fix listed |
| de.mhus.ports/vaadin-shared-deps(Maven) | = 7.4.0 | No fix listed |
| org.hudsonci.lib.guava/guava(Maven) | = 14.0.1-h-1 | No fix listed |
| org.hudsonci.lib.guava/guava(Maven) | = 14.0.1-h-2 | No fix listed |
| org.hudsonci.lib.guava/guava(Maven) | = 14.0.1-h-3 | No fix listed |
| debian/guava-libraries(Debian:12) | < 29.0-1 | 29.0-1 |
| debian/guava-libraries(Debian:13) | < 29.0-1 | 29.0-1 |
| debian/guava-libraries(Debian:14) | < 29.0-1 | 29.0-1 |
| Google Guava | >= 11.0, < 24.1.1 | 24.1.1 |
| redhat openshift container platform | = 3.11 | No fix listed |
| redhat openshift container platform | = 4.1 | No fix listed |
| redhat openstack | = 13 | No fix listed |
| redhat satellite | = 6.4 | No fix listed |
| redhat satellite capsule | = 6.4 | No fix listed |
| redhat virtualization | = 4.2 | No fix listed |
| redhat virtualization | = 4.0 | No fix listed |
| redhat virtualization host | = 4.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.4.0 | No fix listed |
| redhat jboss enterprise application platform | = 7.1.0 | No fix listed |
| oracle banking payments | >= 14.1.0, <= 14.4.0 | No fix listed |
| oracle communications ip service activator | = 7.3.0 | No fix listed |
| oracle communications ip service activator | = 7.4.0 | No fix listed |
| oracle customer management and segmentation foundation | = 18.0 | No fix listed |
| oracle database server | = 12.2.0.1 | No fix listed |
| oracle database server | = 18c | No fix listed |
| oracle database server | = 19c | No fix listed |
| oracle flexcube investor servicing | = 12.1.0 | No fix listed |
| oracle flexcube investor servicing | = 12.3.0 | No fix listed |
| oracle flexcube investor servicing | = 12.4.0 | No fix listed |
| oracle flexcube investor servicing | = 14.0.0 | No fix listed |
| oracle flexcube investor servicing | = 14.1.0 | No fix listed |
| oracle flexcube private banking | = 12.0.0 | No fix listed |
| oracle flexcube private banking | = 12.1.0 | No fix listed |
| oracle retail integration bus | = 15.0 | No fix listed |
| oracle retail integration bus | = 16.0 | No fix listed |
| oracle retail xstore point of service | = 7.1 | No fix listed |
| oracle retail xstore point of service | = 15.0 | No fix listed |
| oracle retail xstore point of service | = 16.0 | No fix listed |
| oracle retail xstore point of service | = 17.0 | No fix listed |
| oracle weblogic server | = 12.2.1.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- groups.google.com vendor-advisory
- 1041707 broken-link vdb-entry
- RHSA-2018:2423 third-party-advisory vendor-advisory
- RHSA-2018:2424 third-party-advisory vendor-advisory
- RHSA-2018:2425 third-party-advisory vendor-advisory
- RHSA-2018:2428 third-party-advisory vendor-advisory
- RHSA-2018:2598 third-party-advisory vendor-advisory
- RHSA-2018:2643 third-party-advisory vendor-advisory
- RHSA-2018:2740 third-party-advisory vendor-advisory
- RHSA-2018:2741 third-party-advisory vendor-advisory
- RHSA-2018:2742 third-party-advisory vendor-advisory
- RHSA-2018:2743 third-party-advisory vendor-advisory
- RHSA-2018:2927 third-party-advisory vendor-advisory
- RHSA-2019:2858 third-party-advisory vendor-advisory
- RHSA-2019:3149 third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com patch third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com patch third-party-advisory
- security.netapp.com
- github.com
- github.com product
- Debian Security Tracker CVE-2018-10237 vendor-advisory
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-project mailing-list
- [cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3 mailing-list
- [activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1 mailing-list
- [activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0 mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-project mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version mailing-list
- [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version mailing-list
- [lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava mailing-list
- [flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list
- [cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237 mailing-list
- [cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
- [storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerability mailing-list
- [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes mailing-list
- [cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
- [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities mailing-list
- [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15? mailing-list
- [flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list
- [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core mailing-list
- [cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka mailing-list
- [lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava mailing-list
- [flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list
- [lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava mailing-list
- [cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
- [hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10 mailing-list
- [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version mailing-list
- [cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
- [flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list