Profile cover photo
Profile photo
Google Guava
9,464 followers -
java opensource library collections google concurrency
java opensource library collections google concurrency

9,464 followers
About
Posts

Guava 26.0 released

Guava 26.0 was released August 1, 2018.

See the release notes (https://github.com/google/guava/releases/tag/v26.0) for more information.
Add a comment...

Guava 25.1 released

Guava 25.1 was released May 23, 2018.

See the release notes (https://github.com/google/guava/releases/tag/v25.1) for more information.
Add a comment...

Post has attachment
Add a comment...

Vulnerability in Guava deserialization

Unbounded memory allocation in Google Guava 11.0 through 24.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Additional Information

During deserialization, two Guava classes accept a caller-specified size parameter and eagerly allocate an array of that size:

- AtomicDoubleArray (when serialized with Java serialization)
- CompoundOrdering (when serialized with GWT serialization)

If a server deserializes instances sent by an attacker, the attacker can quickly force the server to allocate all its memory, without even sending the promised number of elements. Note that most servers that accept serialized data will deserialize objects of these types as long as they are on the classpath, even if they are not used by the server. (It is possible to set up a whitelist or blacklist for Java serialization, but few service owners do. GWT serialization does operate with a whitelist by default, but it is usually a large, automatically generated whitelist that often includes the problem class.)

Guava 25.0 and Guava 24.1.1 have been released, both of which eliminate the eager allocation of the arrays. This fixes the vulnerability.

Note that it will still be possible for an attacker to send an AtomicDoubleArray or CompoundOrdering with a large number of items. However, this problem is endemic to serialization. (For example, it's present in ArrayList.) Service owners who are concerned about this problem should set a limit on the size of the object graph that their servers will accept. (For Java serialization, see JEP 290, which also permits whitelisting and blacklisting of particular classes, useful for defense in depth and as a mitigation if you can't immediately upgrade your version of Guava. For GWT-RPC, consider migrating to another RPC system, as it is deprecated. Aside from migration, we don't know the best practices for GWT-RPC users for addressing the endemic problem.)

Final note for users of old versions of Guava: Guava previously had a batch of similar problems, which were fixed in Guava 19.0.

Metadata

- Vulnerability Type: Other (Unbounded memory allocation)
- Affected Product Code Base: introduced in 11.0; last present in 24.1; fixed in 24.1.1 and 25.0
- Affected Component: code that depends on Guava and uses Java serialization or GWT-RPC
- Attack Type: Remote
- Impact: Denial of Service
- Attack Vectors: To be affected, a server running Guava must deserialize data sent by an attacker (either Java serialization or GWT-RPC).
- Discoverer: Apostolos Giannakidis

This information is available with links to further information at https://github.com/google/guava/wiki/CVE-2018-10237
Add a comment...

Guava 24.1 released

Guava 24.1 was released March 14, 2018.

See the release notes (https://github.com/google/guava/releases/tag/v24.1) for more information.
Add a comment...

Post has attachment
Guava 24.0 released

Guava 24.0 was released February 1, 2018. The Maven version numbers are 24.0-jre and 24.0-android.

See the release notes (https://github.com/google/guava/releases/tag/v24.0) for more information.
guava
guava
github.com
Add a comment...

Post has attachment
Guava 23.6 released

Guava 23.6 was released December 20, 2017. The Maven version numbers are
23.6-jre and 23.6-android.

See the release notes (https://github.com/google/guava/releases/tag/v23.6) for more information.
guava
guava
github.com
Add a comment...

Guava 23.5 released

Guava 23.5 was released November 22, 2017. The Maven version numbers are
23.5-jre and 23.5-android.

See the release notes (https://github.com/google/guava/releases/tag/v23.5) for more information.
Add a comment...

Post has attachment
Guava 23.3 released

Guava 23.3 was released on October 26, 2017. The Maven version numbers are
23.3-jre and 23.3-android.

See the release notes (https://github.com/google/guava/releases/tag/v23.3) for more information.
guava
guava
github.com
Add a comment...

Post has attachment
Guava 23.2 released

Guava 23.2 was released October 11, 2017. The Maven version numbers are 23.2-jre and 23.2-android.

See the release notes (https://github.com/google/guava/releases/tag/v23.2) for more information.
guava
guava
github.com
Add a comment...
Wait while more posts are being loaded