mirror of
https://github.com/0xMarcio/cve.git
synced 2026-05-14 19:18:06 +02:00
0xMarcio
34 lines
1.7 KiB
Markdown
34 lines
1.7 KiB
Markdown
### [CVE-2018-10237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237)
|
|
|
|
|
|
|
|
|
|
### Description
|
|
|
|
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
|
|
|
|
### POC
|
|
|
|
#### Reference
|
|
- https://www.oracle.com/security-alerts/cpuapr2020.html
|
|
- https://www.oracle.com/security-alerts/cpujan2021.html
|
|
- https://www.oracle.com/security-alerts/cpujul2020.html
|
|
- https://www.oracle.com/security-alerts/cpuoct2021.html
|
|
|
|
#### Github
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
- https://github.com/Anonymous-Phunter/PHunter
|
|
- https://github.com/CGCL-codes/PHunter
|
|
- https://github.com/IkerSaint/VULNAPP-vulnerable-app
|
|
- https://github.com/LibHunter/LibHunter
|
|
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
|
|
- https://github.com/diakogiannis/moviebook
|
|
- https://github.com/dotanuki-labs/android-oss-cves-research
|
|
- https://github.com/evervault/evervault-java
|
|
- https://github.com/pctF/vulnerable-app
|
|
- https://github.com/securityranjan/vulnapp
|
|
- https://github.com/singhkranjan/vulnapp
|
|
- https://github.com/surajbabar/dependency-demo-app
|
|
- https://github.com/ytono/gcp-arcade
|
|
|