5.9

CVE-2018-10237

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Guava Version >= 11.0 < 24.1.1
Redhat ≫ Openstack Version13
Redhat ≫ Satellite Version6.4
Redhat ≫ Satellite Capsule Version6.4
Redhat ≫ Virtualization Version4.2
Redhat ≫ Virtualization Host Version4.0
Redhat ≫ Openshift Container Platform Version4.1
   Redhat ≫ Enterprise Linux Version7.0
Redhat ≫ Virtualization Version4.0
   Redhat ≫ Enterprise Linux Version7.0
Redhat ≫ Virtualization Host Version4.0
   Redhat ≫ Enterprise Linux Version7.0
Oracle ≫ Banking Payments Version >= 14.1.0 <= 14.4.0
Oracle ≫ Database Server Version12.2.0.1
Oracle ≫ Database Server Version18c
Oracle ≫ Database Server Version19c
Oracle ≫ Flexcube Private Banking Version12.0.0
Oracle ≫ Flexcube Private Banking Version12.1.0
Oracle ≫ Retail Integration Bus Version15.0
Oracle ≫ Retail Integration Bus Version16.0
Oracle ≫ Weblogic Server Version12.2.1.3.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.26% 0.859
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.