CVE-2018-10237

EPSS 5.12%
Veröffentlicht 26.04.2018 21:29:00
Zuletzt bearbeitet 21.11.2024 03:41:04
Erkennungen
Login

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 56

NVD 39 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Guava Version >= 11.0 < 24.1.1

Redhat ≫ Openshift Container Platform Version 3.11

Redhat ≫ Openstack Version 13

Redhat ≫ Satellite Version 6.4

Redhat ≫ Satellite Capsule Version 6.4

Redhat ≫ Virtualization Version 4.2

Redhat ≫ Virtualization Host Version 4.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.0.0

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.4.0

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Jboss Enterprise Application Platform Version 7.1.0

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Openshift Container Platform Version 4.1

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Virtualization Version 4.0

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Virtualization Host Version 4.0

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.0.0

Redhat ≫ Enterprise Linux Version 5.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.4.0

Redhat ≫ Enterprise Linux Version 5.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.0.0

Redhat ≫ Enterprise Linux Version 6.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.4.0

Redhat ≫ Enterprise Linux Version 6.0

Redhat ≫ Jboss Enterprise Application Platform Version 7.1.0

Redhat ≫ Enterprise Linux Version 6.0

Oracle ≫ Banking Payments Version >= 14.1.0 <= 14.4.0

Oracle ≫ Communications Ip Service Activator Version 7.3.0

Oracle ≫ Communications Ip Service Activator Version 7.4.0

Oracle ≫ Customer Management And Segmentation Foundation Version 18.0

Oracle ≫ Database Server Version 12.2.0.1

Oracle ≫ Database Server Version 18c

Oracle ≫ Database Server Version 19c

Oracle ≫ Flexcube Investor Servicing Version 12.1.0

Oracle ≫ Flexcube Investor Servicing Version 12.3.0

Oracle ≫ Flexcube Investor Servicing Version 12.4.0

Oracle ≫ Flexcube Investor Servicing Version 14.0.0

Oracle ≫ Flexcube Investor Servicing Version 14.1.0

Oracle ≫ Flexcube Private Banking Version 12.0.0

Oracle ≫ Flexcube Private Banking Version 12.1.0

Oracle ≫ Retail Integration Bus Version 15.0

Oracle ≫ Retail Integration Bus Version 16.0

Oracle ≫ Retail Xstore Point Of Service Version 7.1

Oracle ≫ Retail Xstore Point Of Service Version 15.0

Oracle ≫ Retail Xstore Point Of Service Version 16.0

Oracle ≫ Retail Xstore Point Of Service Version 17.0

Oracle ≫ Weblogic Server Version 12.2.1.3.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	5.12%	0.913

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.9	2.2	3.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://www.oracle.com/security-alerts/cpujan2021.html

Patch

Third Party Advisory

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

https://www.oracle.com/security-alerts/cpuoct2021.html

Patch

Third Party Advisory

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

https://www.oracle.com/security-alerts/cpuapr2020.html

Patch

Third Party Advisory

https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E

https://access.redhat.com/errata/RHSA-2018:2927

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Patch

Third Party Advisory

https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E

https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E

https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cdev.flink.apache.org%3E

https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cuser.flink.apache.org%3E

https://access.redhat.com/errata/RHSA-2018:2423

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2424

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2425

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2428

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2740

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2741

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2742

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2743

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149

Third Party Advisory

http://www.securitytracker.com/id/1041707

Broken Link

https://access.redhat.com/errata/RHSA-2018:2598

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2643

Third Party Advisory

https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion

Vendor Advisory

https://lists.apache.org/thread.html/19fa48533bc7ea1accf6b12746a74ed888ae6e49a5cf81ae4f807495%40%3Ccommon-dev.hadoop.apache.org%3E

https://lists.apache.org/thread.html/33c6bccfeb7adf644d4d79894ca8f09370be6ed4b20632c2e228d085%40%3Ccommits.cassandra.apache.org%3E

https://lists.apache.org/thread.html/3d5dbdd92ac9ceaef90e40f78599f9109f2f345252e0ac9d98e7e084%40%3Cgitbox.activemq.apache.org%3E

https://lists.apache.org/thread.html/3ddd79c801edd99c0978e83dbe2168ebd36fd42acfa5dac38fb03dd6%40%3Cissues.activemq.apache.org%3E

https://lists.apache.org/thread.html/cc48fe770c45a74dc3b37ed0817393e0c96701fc49bc431ed922f3cc%40%3Chdfs-dev.hadoop.apache.org%3E

https://lists.apache.org/thread.html/r223bc776a077d0795786c38cbc6e7dd808fce1a9161b00ba9c0a5d55%40%3Cissues.lucene.apache.org%3E

https://lists.apache.org/thread.html/r22c8173b804cd4a420c43064ba4e363d0022aa421008b1989f7354d4%40%3Cissues.flink.apache.org%3E

https://lists.apache.org/thread.html/r27eb79a87a760335226dbfa6a7b7bffea539a535f8e80c41e482106d%40%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/r2ea4e5e5aa8ad73b001a466c582899620961f47d77a40af712c1fdf9%40%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/r30e7d7b6bfa630dacc41649a0e96dad75165d50474c1241068aa0f94%40%3Cissues.storm.apache.org%3E

https://lists.apache.org/thread.html/r38e2ab87528d3c904e7fac496e8fd766b9277656ff95b97d6b6b6dcd%40%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4e748%40%3Ccommits.pulsar.apache.org%3E

https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540%40%3Cdev.syncope.apache.org%3E

https://lists.apache.org/thread.html/r50fc0bcc734dd82e691d36d209258683141bfc0083739a77e56ad92d%40%3Cdev.flink.apache.org%3E

https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba%40%3Cissues.maven.apache.org%3E

https://lists.apache.org/thread.html/r95799427b335807a4c54776908125c3e66597b65845ae50096d9278a%40%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/ra4f44016926dcb034b3b230280a18102062f94ae55b8a31bb92fed84%40%3Cissues.lucene.apache.org%3E

https://lists.apache.org/thread.html/ra8906723927aef2a599398c238eacfc845b74d812e0093ec2fc70a7d%40%3Cissues.flink.apache.org%3E

https://lists.apache.org/thread.html/rb3da574c34bc6bd37972d2266af3093b90d7e437460423c24f477919%40%3Cissues.lucene.apache.org%3E

https://lists.apache.org/thread.html/rc78f6e84f82cc662860e96526d8ab969f34dbe12dc560e22d9d147a3%40%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/rc8467f357b943ceaa86f289f8bc1a5d1c7955b75d3bac1426f2d4ac1%40%3Ccommon-dev.hadoop.apache.org%3E

https://lists.apache.org/thread.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95%40%3Cgithub.arrow.apache.org%3E

https://lists.apache.org/thread.html/rd0c8ec6e044aa2958dd0549ebf8ecead7f5968c9474ba73a504161b2%40%3Cdev.cxf.apache.org%3E

https://lists.apache.org/thread.html/rdc56c15693c236e31e1e95f847b8e5e74fc0a05741d47488e7fc8c45%40%3Cissues.flink.apache.org%3E

https://security.netapp.com/advisory/ntap-20220629-0008/

https://nvd.nist.gov/vuln/detail/CVE-2018-10237

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-10237

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-10237

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2018-10237