Oracle Java SE up to 21.0.1 Hotspot

Summaryinfo

A vulnerability has been found in Oracle Java SE up to 8u391/8u391-perf/11.0.21/17.0.9/21.0.1 and classified as critical. This issue affects some unknown processing of the component Hotspot. This manipulation causes an unknown weakness. This vulnerability appears as CVE-2024-20919. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Oracle Java SE up to 8u391/8u391-perf/11.0.21/17.0.9/21.0.1 (Programming Language Software). It has been declared as critical. Affected by this vulnerability is an unknown part of the component Hotspot. As an impact it is known to affect integrity. The summary by CVE is:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

The weakness was presented 01/16/2024 as Oracle Critical Patch Update Advisory - January 2024. The advisory is shared at oracle.com. This vulnerability is known as CVE-2024-20919. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/09/2024). It is expected to see the exploit prices for this product decreasing in the near future.

The vulnerability scanner Nessus provides a plugin with the ID 210735 (Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : OpenJDK 8 vulnerabilities (USN-7096-1)), which helps to determine the existence of the flaw in a target environment.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210735). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• Java SE

Version

• 8u391
• 8u391-perf
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10
• 11.0.11
• 11.0.12
• 11.0.13
• 11.0.14
• 11.0.15
• 11.0.16
• 11.0.17
• 11.0.18
• 11.0.19
• 11.0.20
• 11.0.21
• 17.0.0
• 17.0.1
• 17.0.2
• 17.0.3
• 17.0.4
• 17.0.5
• 17.0.6
• 17.0.7
• 17.0.8
• 17.0.9
• 21.0.0
• 21.0.1

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion