Strix
26.1K

CVE-2018-10237

MEDIUMCVSS 5.9/10EPSS 5.12%

Last modified

CVE-2018-10237 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.. EPSS estimates a 5.12% chance of exploitation in the next 30 days.

Description

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
5.12%

91.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GoogleGuava>= 11.0, < 24.1.1
RedhatOpenshift Container Platform3.11
RedhatOpenstack13
RedhatSatellite6.4
RedhatSatellite Capsule6.4
RedhatVirtualization4.2
RedhatVirtualization Host4.0
RedhatJboss Enterprise Application Platform6.0.0
RedhatJboss Enterprise Application Platform6.4.0
RedhatJboss Enterprise Application Platform7.1.0
RedhatOpenshift Container Platform4.1
RedhatVirtualization4.0
OracleBanking Payments>= 14.1.0, <= 14.4.0
OracleCommunications Ip Service Activator7.3.0
OracleCommunications Ip Service Activator7.4.0
OracleCustomer Management And Segmentation Foundation18.0
OracleDatabase Server12.2.0.1
OracleDatabase Server18c
OracleDatabase Server19c
OracleFlexcube Investor Servicing12.1.0
OracleFlexcube Investor Servicing12.3.0
OracleFlexcube Investor Servicing12.4.0
OracleFlexcube Investor Servicing14.0.0
OracleFlexcube Investor Servicing14.1.0
OracleFlexcube Private Banking12.0.0
OracleFlexcube Private Banking12.1.0
OracleRetail Integration Bus15.0
OracleRetail Integration Bus16.0
OracleRetail Xstore Point Of Service7.1
OracleRetail Xstore Point Of Service15.0
OracleRetail Xstore Point Of Service16.0
OracleRetail Xstore Point Of Service17.0
OracleWeblogic Server12.2.1.3.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-10237?
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
How severe is CVE-2018-10237?
CVE-2018-10237 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 5.12% probability of exploitation in the next 30 days.
How do I fix CVE-2018-10237?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-10237?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST