REDHAT-BUG-1730056: Medium severity Oracle OpenJDK vulnerability
It was discovered that the implementation of the Collections class in the Utilities component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker must be able to provide specially crafted serialized input that a Java application deserializes. The supplied data can trigger excessive memory allocation during object creation.
What is the likely impact on an affected application?
Deserializing the crafted input can cause the application to consume an excessive amount of memory. This may impair availability of the Java application.
How can I determine whether an application is exposed?
Review whether the application deserializes input that can be influenced by untrusted parties, particularly serialized Java object data. Applications that do not deserialize such input are not exposed through this described attack path.