CVE-2021-28167: Medium severity ibm cognos analytics vulnerability
Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by a flaw in the jdk.internal.reflect.ConstantPool API. By sending a specially-crafted request, an attacker could exploit this vulnerability to call static methods or access static members without running the class initialization method.
Other sources
In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method, and may allow a user to observe uninitialized values.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-28167?
CVE-2021-28167 is a vulnerability in Eclipse Openj9 version 0.25.0 that allows the JVM to pre-resolve certain constant pool entries, enabling a user to call static methods or access static members without running the class initialization method.
How does CVE-2021-28167 impact Eclipse Openj9?
CVE-2021-28167 allows users to bypass class initialization methods and call static methods or access static members directly, resulting in potential unauthorized access or privilege escalation.
What is the severity of CVE-2021-28167?
CVE-2021-28167 has a severity rating of 6.5 (Medium).
How can I mitigate CVE-2021-28167?
To mitigate CVE-2021-28167, update Eclipse Openj9 to a version beyond 0.25.0 that contains the necessary security patches.
Where can I find more information about CVE-2021-28167?
More information about CVE-2021-28167 can be found at the following reference: https://github.com/eclipse/openj9/issues/12016