REDHAT-BUG-1471898: High severity OpenJDK Nashorn JavaScript engine vulnerability

Published Jul 17, 2017

Updated

It was discovered that the Nashorn JavaScript engine in the Scripting component of OpenJDK could allow JavaScripts to access Java APIs even when access to Java APIs was disabled. An untrusted JavaScript executed by Nashorn could use this flaw to bypass intended restrictions.

Affected Software

1 affected component

OpenJDK Nashorn JavaScript engine

Event History

Jul 17, 2017

Data Sourced

via Red Hat·03:30 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1471898?

The severity of REDHAT-BUG-1471898 is classified as critical due to the potential for unauthorized Java API access.

How do I fix REDHAT-BUG-1471898?

To mitigate REDHAT-BUG-1471898, update the OpenJDK Nashorn JavaScript engine to the latest patched version.

What systems are affected by REDHAT-BUG-1471898?

REDHAT-BUG-1471898 primarily affects systems running the OpenJDK Nashorn JavaScript engine.

What is the impact of REDHAT-BUG-1471898?

The impact of REDHAT-BUG-1471898 includes the risk of untrusted JavaScript executing and bypassing Java API restrictions.

How can I verify if I am vulnerable to REDHAT-BUG-1471898?

You can verify if you are vulnerable to REDHAT-BUG-1471898 by checking your current version of the OpenJDK Nashorn JavaScript engine against the known unaffected versions.