CVE-2018-10237

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

References

https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion

https://access.redhat.com/errata/RHSA-2018:2428

https://access.redhat.com/errata/RHSA-2018:2425

https://access.redhat.com/errata/RHSA-2018:2424

https://access.redhat.com/errata/RHSA-2018:2423

https://access.redhat.com/errata/RHSA-2018:2598

https://access.redhat.com/errata/RHSA-2018:2643

https://access.redhat.com/errata/RHSA-2018:2743

https://access.redhat.com/errata/RHSA-2018:2742

https://access.redhat.com/errata/RHSA-2018:2741

https://access.redhat.com/errata/RHSA-2018:2740

http://www.securitytracker.com/id/1041707

https://access.redhat.com/errata/RHSA-2018:2927

https://lists.apache.org/thread.html/[email protected]%3Chdfs-dev.hadoop.apache.org%3E

https://lists.apache.org/thread.html/19fa48533bc7ea1accf6b12746a74ed888ae6e49a5cf81ae4f8074[email protected]%3Ccommon-dev.hadoop.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccommits.pulsar.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cgitbox.activemq.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccommits.cassandra.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E

https://access.redhat.com/errata/RHSA-2019:2858

https://lists.apache.org/thread.html/[email protected]%3Cdev.drill.apache.org%3E

https://access.redhat.com/errata/RHSA-2019:3149

https://lists.apache.org/thread.html/[email protected]%3Cissues.drill.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cusers.kafka.apache.org%3E

https://www.oracle.com/security-alerts/cpuapr2020.html

https://lists.apache.org/thread.html/[email protected]%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.syncope.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccommon-dev.hadoop.apache.org%3E

https://www.oracle.com/security-alerts/cpujul2020.html

https://lists.apache.org/thread.html/[email protected]%3Cuser.flink.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.flink.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.flink.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.flink.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.flink.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.lucene.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.lucene.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.lucene.apache.org%3E

https://www.oracle.com/security-alerts/cpujan2021.html

https://lists.apache.org/thread.html/[email protected]%3Cissues.maven.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.flink.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccommits.samza.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.storm.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccommits.pulsar.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cgithub.arrow.apache.org%3E

https://www.oracle.com/security-alerts/cpuoct2021.html

Details

Source: MITRE

Published: 2018-04-26

Updated: 2021-10-20

Type: CWE-770

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 5.9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 2.2

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:google:guava:*:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*

cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*

cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:*

cpe:2.3:a:redhat:virtualization:4.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*

Configuration 3

AND

OR

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*

OR

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 4

AND

OR

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*

OR

cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*

Configuration 5

AND

OR

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*

OR

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

Configuration 6

OR

cpe:2.3:a:oracle:banking_payments:*:*:*:*:*:*:*:* versions from 14.1.0 to 14.4.0 (inclusive)

cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*

cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

Tenable Plugins

View all (13 total)

IDNameProductFamilySeverity
154771Oracle WebLogic Server Multiple Vulnerabilities (Oct 2021 CPU)NessusMisc.
critical
154342Oracle GoldenGate (Oct 2021 CPU)NessusMisc.
high
145264Oracle WebLogic Server Multiple Vulnerabilities (Jan 2021 CPU)NessusMisc.
critical
120756Fedora 28 : guava20 (2018-bf292e6cdf)NessusFedora Local Security Checks
medium
120431Fedora 28 : guava (2018-54a5bcc7e4)NessusFedora Local Security Checks
medium
118185RHEL 7 : Satellite Server (RHSA-2018:2927)NessusRed Hat Local Security Checks
critical
117772RHEL 6 : JBoss EAP (RHSA-2018:2743)NessusRed Hat Local Security Checks
high
117771RHEL 7 : JBoss EAP (RHSA-2018:2741)NessusRed Hat Local Security Checks
high
117324RHEL 7 : Virtualization (RHSA-2018:2643)NessusRed Hat Local Security Checks
high
112030RHEL 7 : JBoss EAP (RHSA-2018:2424)NessusRed Hat Local Security Checks
high
112029RHEL 6 : JBoss EAP (RHSA-2018:2423)NessusRed Hat Local Security Checks
high
109927Fedora 27 : guava (2018-e4c2507720)NessusFedora Local Security Checks
medium
109804Fedora 26 : guava (2018-db8f322bb0)NessusFedora Local Security Checks
medium