CVE-2018-10237: Denial of Service in Google Guava
Summary
CVE-2018-10237: Denial of Service in Google Guava. Affects com.google.guava:guava versions >= 11.0, < 24.1.1-android. Fixed in 24.1.1-android. How to fix ↓
Also tracked for
- guava-libraries · Debian:11
The same CVE-2018-10237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Google Guava is an open-source Java library that provides a set of utility classes for common programming tasks. It offers functionalities such as collections, caching, and functional programming. This vulnerability affects versions 11.0 through 24.x before 24.1.1 of the Guava library. The vulnerability allows remote attackers to conduct denial of service attacks against servers that depend on this library. The issue arises when deserializing attacker-provided data, as the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on the data size sent by the client.
Vulnerability Detail
The unbounded memory allocation vulnerability in Google Guava can be exploited by remote attackers to launch denial of service attacks. By sending specially crafted data, an attacker can cause servers that rely on the Guava library to allocate excessive memory, leading to resource exhaustion and potential service disruption. The vulnerability arises due to the lack of proper checks on the size of data sent by the client during deserialization of the AtomicDoubleArray class and the CompoundOrdering class. This can result in uncontrolled memory allocation, impacting the availability of the affected system.
How To Fix
Minimum fixed version
24.1.1-android
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version of the Guava library is not immediately feasible, developers can implement input validation and size checks on the deserialized data. By enforcing reasonable limits on the data size, the risk of resource exhaustion can be mitigated. However, this workaround should be considered temporary, and upgrading to the patched version is strongly recommended.
Conclusion
The unbounded memory allocation vulnerability in Google Guava can lead to denial of service attacks against servers relying on the library. It is crucial to upgrade to the patched version of the Guava library (24.1.1 or later) to mitigate this vulnerability. Regularly updating and patching all dependencies is essential to ensure the security of the software. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.google.guava:guava →
FAQ
The vulnerability allows remote attackers to conduct denial of service attacks against servers that rely on the Guava library. By exploiting the unbounded memory allocation issue, an attacker can cause resource exhaustion and potentially disrupt the availability of the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
Yes, developers can implement input validation and size checks on the deserialized data as a temporary workaround. However, upgrading to the patched version of the Guava library is strongly recommended.
To fix this vulnerability, you should upgrade the Guava library to version 24.1.1 or later. This version includes the necessary fixes to address the unbounded memory allocation issue.
Related vulnerabilities
Recent vulnerabilities recorded for com.google.guava:guava.
