CVE-2018-10237: Medium severity Google Guava vulnerability
Google Guava versions 11.0 through 24.1 are vulnerable to unbounded memory allocation in the AtomicDoubleArray class (when serialized with Java serialization) and Compound Ordering class (when serialized with GWT serialization). An attacker could exploit applications that use Guava and deserialize untrusted data to cause a denial of service.
External References:
https://github.com/google/guava/wiki/CVE-2018-10237 https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion
Upstream Patch:
https://github.com/google/guava/commit/7ec8718f1e6e2814dabaa4b9f96b6b33a813101c
Other sources
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10237?
CVE-2018-10237 has a severity rating indicating it can lead to denial of service conditions.
How do I fix CVE-2018-10237?
To fix CVE-2018-10237, users should upgrade to Google Guava version 24.1.1 or later.
Which versions of Google Guava are affected by CVE-2018-10237?
Google Guava versions from 11.0 to 24.1.1 are affected by CVE-2018-10237.
Are there any workarounds for CVE-2018-10237?
Currently, the recommended solution for CVE-2018-10237 is to upgrade to a patched version rather than relying on workarounds.
What kind of attack does CVE-2018-10237 enable?
CVE-2018-10237 allows attackers to cause a denial of service by sending specially-crafted data.