CVE-2019-17639: Infoleak
Eclipse OpenJ9 could allow a remote attacker to obtain sensitive information, caused by the premature return of the current method with an undefined return value. By invoking the System.arraycopy method with a length longer than the length of the source or destination array can, an attacker could exploit this vulnerability to obtain sensitive information.
Other sources
In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-17639?
CVE-2019-17639 is a vulnerability in Eclipse OpenJ9 that could allow a remote attacker to obtain sensitive information.
What is the severity of CVE-2019-17639?
The severity of CVE-2019-17639 is medium, with a severity value of 5.3.
How does CVE-2019-17639 affect Eclipse OpenJ9?
CVE-2019-17639 affects Eclipse OpenJ9 prior to version 0.21 on Power platforms.
How can I fix CVE-2019-17639 in Eclipse OpenJ9?
To fix CVE-2019-17639 in Eclipse OpenJ9, you should update to version 0.21 or later.
Where can I find more information about CVE-2019-17639?
You can find more information about CVE-2019-17639 at the following links: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/185437), [IBM Support](https://www.ibm.com/support/pages/node/6256562), [CVE.org](https://www.cve.org/CVERecord?id=CVE-2019-17639), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-17639).