| Package | Affected versions | Patched versions |
|---|---|---|
| com.google.guava:guava | ≥ 11.0, < 24.1.1-android | 24.1.1-android |
| com.google.guava:guava-jdk5 | ≤ 17.0 | |
| com.googlecode.guava-osgi:guava-osgi | ≤ 11.0.1 | |
| de.mhus.ports:vaadin-shared-deps | ≤ 7.4.0 | |
| org.hudsonci.lib.guava:guava | ≤ 14.0.1-h-3 | |
| org.sonatype.sisu:sisu-guava | = 0.11.1 | |
| guava | ≥ 11.0, < 24.1.1 | 24.1.1 |
| banking payments | ≥ 14.1.0, ≤ 14.4.0 | |
| communications ip service activator | = 7.3.0= 7.4.0 | |
| customer management and segmentation foundation | = 18.0 | |
| database server | = 12.2.0.1= 18c= 19c | |
| flexcube investor servicing | = 12.1.0= 12.3.0= 12.4.0= 14.0.0= 14.1.0 | |
| flexcube private banking | = 12.0.0= 12.1.0 | |
| retail integration bus | = 15.0= 16.0 | |
| retail xstore point of service | = 15.0= 16.0= 17.0= 7.1 | |
| weblogic server | = 12.2.1.3.0 | |
| jboss enterprise application platform | = 6.0.0= 6.4.0= 7.1.0 | |
| openshift container platform | = 3.11= 4.1 | |
| openstack | = 13 | |
| satellite | = 6.4 | |
| satellite capsule | = 6.4 | |
| virtualization | = 4.0= 4.2 | |
| virtualization host | = 4.0 |
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free