CVE-2019-2842: Low severity Oracle JDK vulnerability
It was discovered that crypto provider implementations in the JCE component of OpenJDK for crypto algorithms such as AES or SHA did not perform array bounds checks. This could lead to out-of-bounds access if compiler intrinsics were used instead of the Java runtime implementations of the specific operations.
Other sources
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-2842?
CVE-2019-2842 is a vulnerability in the Java SE component of Oracle Java SE, specifically in the JCE (Java Cryptography Extension) subcomponent.
What is the severity of CVE-2019-2842?
CVE-2019-2842 has a severity level of medium (3.7).
How can an attacker exploit CVE-2019-2842?
An unauthenticated attacker with network access via multiple protocols can exploit CVE-2019-2842 to compromise Java SE.
Which versions of Java SE are affected by CVE-2019-2842?
Java SE version 8u212 is the supported version affected by CVE-2019-2842.
How do I fix CVE-2019-2842?
To fix CVE-2019-2842, it is recommended to update to the latest available version of Java SE (8u212 or higher) provided by Oracle or your respective software vendor.