CVE-2018-10237
- State
- Published
- Severity
- Not scored
- Published
- Apr 26, 2018
- Updated
- Aug 5, 2024
- Reserved
- Apr 20, 2018
Description
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2018:2428vendor-advisory
- RHSA-2018:2740vendor-advisory
- RHSA-2018:2741vendor-advisory
- RHSA-2018:2742vendor-advisory
- RHSA-2018:2598vendor-advisory
- RHSA-2018:2643vendor-advisory
- RHSA-2018:2424vendor-advisory
- RHSA-2018:2423vendor-advisory
- RHSA-2018:2425vendor-advisory
- RHSA-2018:2927vendor-advisory
- 1041707vdb-entry
- RHSA-2018:2743vendor-advisory
- [hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-projectmailing-list
- [hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-projectmailing-list
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1mailing-list
- [activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0mailing-list
- [activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1mailing-list
- [cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3mailing-list
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jarmailing-list
- RHSA-2019:2858vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- RHSA-2019:3149vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237mailing-list
- [cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237mailing-list
- [cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237mailing-list
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafkamailing-list
- [cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237mailing-list
- [cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237mailing-list
- [cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237mailing-list
- [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15?mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion
- [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 versionmailing-list
- [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 versionmailing-list
- [flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependencymailing-list
- [flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependencymailing-list
- [flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependencymailing-list
- [lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guavamailing-list
- [lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guavamailing-list
- [lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guavamailing-list
- https://www.oracle.com/security-alerts/cpujan2021.html
- [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-coremailing-list
- [flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependencymailing-list
- [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixesmailing-list
- [storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerabilitymailing-list
- [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilitiesmailing-list
- [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava versionmailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20220629-0008/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.