REDHAT-BUG-1889271: Low severity ORACLE OpenJDK vulnerability
It was discovered that the implementation of the Proxy class in the Serialization component of OpenJDK could trigger an out-of-memory condition when deserializing Proxy class objects with many interfaces. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.
The patch for this issue adds a new system property jdk.serialProxyInterfaceLimit that can be used to reduce the limit for Proxy interfaces from the default of 65535 and hence better protect against excessive memory usage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the system property jdk.serialProxyInterfaceLimit to a lower limit than the default 65535 to reduce the number of Proxy interfaces accepted during deserialization and mitigate out-of-memory conditions.
Java OpenJDK Serialization (Proxy class in Serialization component) jdk.serialProxyInterfaceLimit = <set to a lower value than the default 65535>
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1889271?
The severity of REDHAT-BUG-1889271 is high due to its potential to cause out-of-memory conditions in Java applications.
How do I fix REDHAT-BUG-1889271?
To fix REDHAT-BUG-1889271, you should update your OpenJDK to the latest version that addresses this vulnerability.
What platform is affected by REDHAT-BUG-1889271?
REDHAT-BUG-1889271 specifically affects Oracle OpenJDK, especially versions around 17.
What are the risks associated with REDHAT-BUG-1889271?
The risks associated with REDHAT-BUG-1889271 include potential application crashes and service interruptions due to excessive memory usage.
Can REDHAT-BUG-1889271 be exploited remotely?
Yes, a specially-crafted input can be used remotely to exploit REDHAT-BUG-1889271, leading to potential denial of service.