CVE-2018-10237 — Denial of Service in Google Guava

Description

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	guava-libraries	29.0-1	—
Debian 13	guava-libraries	29.0-1	—
Debian 12	guava-libraries	29.0-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	guava-libraries	No fix yet	—
Ubuntu 18.04 LTS	guava-libraries	No fix yet	—
Ubuntu 16.04 LTS	guava-libraries	No fix yet	—
Ubuntu 14.04 LTS	guava-libraries	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	rhvm-appliance	2:4.2-20180828.0.el7	RHSA-2018:2643

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Satellite Capsule 6	SOAPpy	0.11.6-17.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	ansiblerole-insights-client	1.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman +1	1.18.0.37-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-bootloaders-redhat +1	201801241201-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-installer	1:1.18.0.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-proxy +1	1.18.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	gofer +2	2.12.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	hfsplus-tools	332.14-12.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello +3	3.7.0-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-certs-tools	2.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-client-bootstrap	1.6.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-installer-base +1	3.7.0.10-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-selinux	3.0.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	kobo	0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	libstemmer	0-2.585svn.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	libwebsockets	2.1.0-3.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mod_passenger +3	4.0.18-24.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mod_xsendfile	0.12-10.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mongodb +1	2.6.11-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	ostree	2017.1-2.atomic.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp +14	2.16.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-docker +3	3.1.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-katello	1.0.2-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-ostree +4	1.3.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-puppet +3	2.16.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-rpm +4	2.16.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-agent	5.5.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-foreman_scap_client	0.3.16-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppetserver	5.3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-amqp +1	2.2.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-anyjson	0.3.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-blinker	1.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-bson +2	3.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-celery +1	4.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-crane	3.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-django +1	1.11.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-flask	1:0.10.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-fpconst	0.7.3-12.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-gnupg	0.3.7-1.el7ui	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-isodate	0.5.0-5.pulp.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-itsdangerous	0.23-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-jinja2	2.7.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-kid	0.9.6-11.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-kombu +1	1:4.0.2-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-nectar	1.5.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-oauth2	1.5.211-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-okaara	1.0.32-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-qpid	1.35.0-5.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-simplejson	3.2.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-twisted-core	12.2.0-4.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-twisted-web	12.1.0-5.el7_2	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-vine +1	1.1.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-werkzeug	0.9.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-zope-interface	4.0.5-4.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-cpp +6	1.36.0-19.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-dispatch +2	0.8.0-19.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-proton +2	0.16.0-12.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	redhat-access-insights-puppet	0.0.9-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	repoview	0.6.6-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-ansi	1.4.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-bundler_ext +1	0.4.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-clamp +1	1.1.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-concurrent-ruby	1:1.0.3-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-fast_gettext	1.1.0-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-ffi	1.4.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-gssapi	1.1.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-hashie +1	2.0.5-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-highline +1	1.7.8-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo	2.1.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo_parsers	0.1.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo_wizards	0.0.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-little-plugger +1	1.1.3-22.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-logging	2.2.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-mime-types	1.19-7.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-multi_json	1.12.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-netrc	0.7.7-9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-newt	0.9.6-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-oauth +1	0.5.4-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-openscap	0.4.7-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-powerbar +1	1.0.17-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rack	1:1.6.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rack-protection	1.5.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rake	0.9.2.2-41.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rb-inotify	0.9.7-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rest-client	1.6.7-7.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rkerberos	0.1.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rsec	0.4.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rubyipmi	0.10.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-sinatra	1:1.4.7-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_ansible	2.0.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_dhcp_remote_isc	0.0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_discovery	1.0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_discovery_image	1.0.9-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_dynflow +1	0.2.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_openscap	0.6.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_remote_execution_ssh	0.2.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-tilt	1.3.7-2.git.0.3b416c9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	saslwrapper +1	0.22-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	satellite +3	6.4.0-15.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	satellite-installer	6.4.0.7-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm +1	4.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51 +1	1.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-concurrent-ruby +1	1.0.5-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mime-types	3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mime-types-data	3.2016.0521-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-multi_json	1.12.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mustermann	1.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-rack	2.0.3-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-sinatra +1	2.0.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-sqlite3	1.3.13-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-tilt	2.0.8-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-algebrick	0.7.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-bindings	0.2.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-params	0.0.5-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-awesome_print	1.8.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby-edge	1:0.2.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-domain_name	0.5.20160310-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-dynflow	1.0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-fast_gettext	1.4.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-ffi	1.4.0-11.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman-tasks-core	0.2.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_ansible_core	2.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_remote_execution_core	1.1.3-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-gssapi	1.2.0-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli	0.13.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_bootdisk	0.1.3.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_docker	0.0.6-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_tasks	0.0.12-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-http-cookie	1.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-locale	2.0.9-12.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-logging	2.2.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh	4.0.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh-krb	0.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-netrc	0.11.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-rest-client	2.0.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-sequel	5.7.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unf	0.1.3-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unf_ext	0.0.6-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unicode	0.4.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	v8	1:3.14.5.10-19.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	yaml-cpp	0.5.1-7.el7sat	RHSA-2018:2927
Red Hat Satellite 6	SOAPpy	0.11.6-17.el7	RHSA-2018:2927
Red Hat Satellite 6	ansiblerole-insights-client	1.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	candlepin +1	2.4.8-1.el7	RHSA-2018:2927
Red Hat Satellite 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman +13	1.18.0.37-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-bootloaders-redhat +1	201801241201-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-installer	1:1.18.0.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-proxy +1	1.18.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	gofer +2	2.12.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	hfsplus-tools	332.14-12.el7	RHSA-2018:2927
Red Hat Satellite 6	katello +4	3.7.0-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-certs-tools	2.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-client-bootstrap	1.6.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-installer-base +1	3.7.0.10-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-selinux	3.0.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	kobo	0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	libwebsockets	2.1.0-3.el7	RHSA-2018:2927
Red Hat Satellite 6	liquibase	3.1.0-1.el7	RHSA-2018:2927
Red Hat Satellite 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2018:2927
Red Hat Satellite 6	mod_passenger	4.0.18-24.el7sat	RHSA-2018:2927
Red Hat Satellite 6	mod_xsendfile	0.12-10.el7sat	RHSA-2018:2927
Red Hat Satellite 6	ostree	2017.1-2.atomic.el7	RHSA-2018:2927
Red Hat Satellite 6	pcp-mmvstatsd	0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp +10	2.16.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-docker +3	3.1.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-katello	1.0.2-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-ostree +3	1.3.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-puppet +4	2.16.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-rpm +4	2.16.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-agent	5.5.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-foreman_scap_client	0.3.16-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppetserver	5.3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-amqp +1	2.2.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-anyjson	0.3.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-blinker	1.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-bson +2	3.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-celery +1	4.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-crane	3.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-django +1	1.11.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-flask	1:0.10.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-fpconst	0.7.3-12.el7	RHSA-2018:2927
Red Hat Satellite 6	python-gnupg	0.3.7-1.el7ui	RHSA-2018:2927
Red Hat Satellite 6	python-isodate	0.5.0-5.pulp.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-itsdangerous	0.23-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-jinja2	2.7.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-kid	0.9.6-11.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-kombu +1	1:4.0.2-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-nectar	1.5.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-oauth2	1.5.211-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-okaara	1.0.32-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-qpid	1.35.0-5.el7	RHSA-2018:2927
Red Hat Satellite 6	python-saslwrapper	0.22-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-simplejson	3.2.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-twisted-core	12.2.0-4.el7	RHSA-2018:2927
Red Hat Satellite 6	python-twisted-web	12.1.0-5.el7_2	RHSA-2018:2927
Red Hat Satellite 6	python-vine +1	1.1.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-werkzeug	0.9.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-zope-interface	4.0.5-4.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-cpp +7	1.36.0-19.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-dispatch +2	0.8.0-19.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-proton +2	0.16.0-12.el7sat	RHSA-2018:2927
Red Hat Satellite 6	redhat-access-insights-puppet	0.0.9-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	repoview	0.6.6-4.el7sat	RHSA-2018:2927
Red Hat OpenStack 13	opendaylight	8.3.0-3.el7ost	RHSA-2018:2598
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	1.5.5.013-1.redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-bouncycastle +3	1.56.0-5.redhat_3.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-guava +1	25.0.0-1.redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-hibernate +5	5.1.15-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.10-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-jberet +1	1.2.6-2.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.11-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.8-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-jboss-server-migration +18	1.0.6-4.Final_redhat_4.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-mod_cluster	1.3.10-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-narayana +10	5.5.32-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-picketlink-api +9	2.5.5-13.SP12_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-resteasy +16	3.0.26-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-undertow	1.4.18-7.SP8_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-wildfly +1	7.1.4-1.GA_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-wildfly-javadocs	7.1.4-2.GA_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.9-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-wildfly-openssl-linux	1.0.6-14.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.0.4-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 7	eap7-wildfly-web-console-eap	2.9.18-1.Final_redhat_1.1.ep7.el6	RHSA-2018:2424, RHSA-2018:2423
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-14.redhat_7.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	guava-libraries	13.0.1-5.redhat_3.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	hibernate4-validator	4.3.4-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	hornetq	2.3.25-27.SP28_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.42-2.Final_redhat_2.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-as-ee +54	7.5.21-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.41-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-modules	1.3.11-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-vfs2	3.2.13-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-xnio-base	3.0.17-1.GA_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jbossas-core +6	7.5.21-2.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jbossas-javadocs	7.5.21-2.Final_redhat_1.2.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jbossweb	7.5.29-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	picketlink-bindings	2.5.4-23.SP18_redhat_2.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	picketlink-federation	2.5.4-21.SP18_redhat_2.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	xerces-j2-eap6	2.9.1-19.redhat_8.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	druid	35.0.1-r1	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.google.guava:guava	>= 11.0, < 24.1.1-android	24.1.1-android	GHSA-mvr2-9pj6-7w5j
Maven	com.google.guava:guava-jdk5	<= 17.0	—	GHSA-mvr2-9pj6-7w5j
Maven	com.googlecode.guava-osgi:guava-osgi	<= 11.0.1	—	GHSA-mvr2-9pj6-7w5j
Maven	de.mhus.ports:vaadin-shared-deps	<= 7.4.0	—	GHSA-mvr2-9pj6-7w5j
Maven	org.hudsonci.lib.guava:guava	<= 14.0.1-h-3	—	GHSA-mvr2-9pj6-7w5j
Maven	org.sonatype.sisu:sisu-guava	0.11.1	—	GHSA-mvr2-9pj6-7w5j

Advisories 13

RHSA-2018:2927 Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2742 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2743 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2741 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2598 Red Hat Security Advisory: opendaylight security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2643 Red Hat Security Advisory: rhvm-appliance security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2424 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2423 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
WID-SEC-2023-1664 IBM Integration Bus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 4, 2023
WID-SEC-2023-1594 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2023

References

RHSA-2018:2428 vendor-advisory
RHSA-2018:2740 vendor-advisory
RHSA-2018:2741 vendor-advisory
RHSA-2018:2742 vendor-advisory
RHSA-2018:2598 vendor-advisory
RHSA-2018:2643 vendor-advisory
RHSA-2018:2424 vendor-advisory
RHSA-2018:2423 vendor-advisory
RHSA-2018:2425 vendor-advisory
RHSA-2018:2927 vendor-advisory
1041707 vdb-entry
RHSA-2018:2743 vendor-advisory
[hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-project mailing-list
[hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-project mailing-list
[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
[activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0 mailing-list
[activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1 mailing-list
[cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3 mailing-list
[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806 mailing-list
RHSA-2019:2858 vendor-advisory
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
RHSA-2019:3149 vendor-advisory
[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
[cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237 mailing-list
[cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
[cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
[kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka mailing-list
[cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
[cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
[cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237 mailing-list
[syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15? mailing-list
https://www.oracle.com/security-alerts/cpuapr2020.html
[hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10 mailing-list
https://www.oracle.com/security-alerts/cpujul2020.html
https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion
[flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version mailing-list
[flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version mailing-list
[flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list
[flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list
[flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list
[lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava mailing-list
[lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava mailing-list
[lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava mailing-list
https://www.oracle.com/security-alerts/cpujan2021.html
[maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core mailing-list
[flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency mailing-list
[samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes mailing-list
[storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerability mailing-list
[pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities mailing-list
[arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version mailing-list
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20220629-0008/