CVEvulnerability

CVE-2018-10237

5.9 MEDIUM Published 2018-04-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-770

Description

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Affected configurations

• google guava (>= 11.0 < 24.1.1) • redhat openshift container platform 3.11 • redhat openstack 13 • redhat satellite 6.4 • redhat satellite capsule 6.4 • redhat virtualization 4.2 • redhat virtualization host 4.0 • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise application platform 6.4.0 • redhat jboss enterprise application platform 7.1.0 • redhat openshift container platform 4.1 • redhat virtualization 4.0 • oracle banking payments (>= 14.1.0 <= 14.4.0) • oracle communications ip service activator 7.3.0 • oracle communications ip service activator 7.4.0 • oracle customer management and segmentation foundation 18.0 • oracle database server 12.2.0.1 • oracle database server 18c • oracle database server 19c • oracle flexcube investor servicing 12.1.0 • oracle flexcube investor servicing 12.3.0 • oracle flexcube investor servicing 12.4.0 • oracle flexcube investor servicing 14.0.0 • oracle flexcube investor servicing 14.1.0 • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle retail integration bus 15.0 • oracle retail integration bus 16.0 • oracle retail xstore point of service 7.1 • oracle retail xstore point of service 15.0 • oracle retail xstore point of service 16.0 • oracle retail xstore point of service 17.0 • oracle weblogic server 12.2.1.3.0

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References