REDHAT-BUG-1730415: Medium severity ORACLE OpenJDK vulnerability
It was discovered that the implementation of the Throwable class in the Utilities component of OpenJDK did not sufficiently validate serial stream before deserializing suppressed exceptions. A specially-crafted input could cause a Java application to construct inconsistent object and possibly use an excessive amount of system resources when deserialized.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to supply a specially crafted serialized input that the Java application deserializes. The issue is triggered while deserializing suppressed exceptions in the Throwable implementation.
What is the likely impact on an affected application?
The crafted input can cause the application to construct an inconsistent object and may cause excessive consumption of system resources.
How can I determine whether my environment may be exposed?
Review whether the application deserializes untrusted or externally supplied Java serialized data, particularly data that may contain exception objects or suppressed exceptions. The provided information does not identify affected version ranges.