REDHAT-BUG-2041417: Medium severity OpenJDK Libraries vulnerability

Published Jan 17, 2022

Updated

It was discovered that the StringBuffer and StringBuilder classes implementation in the Libraries component of OpenJDK failed to properly validate the value of the count attribute during object deserialization. A specially-crafted input could cause a Java application to misbehave because of StringBuffer or StringBuilder object instances in an inconsistent state.

Affected Software

1 affected component

OpenJDK Libraries

Event History

Jan 17, 2022

Data Sourced

via Red Hat·10:30 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2041417?

The severity of REDHAT-BUG-2041417 is considered high due to its potential to cause Java applications to misbehave.

How do I fix REDHAT-BUG-2041417?

To fix REDHAT-BUG-2041417, it is recommended to update your OpenJDK Libraries to the latest version that addresses this vulnerability.

What types of applications are affected by REDHAT-BUG-2041417?

Applications that utilize the StringBuffer and StringBuilder classes in the OpenJDK Libraries are affected by REDHAT-BUG-2041417.

What should I do if I cannot update my OpenJDK version to mitigate REDHAT-BUG-2041417?

If you cannot update your OpenJDK version, consider implementing input validation to mitigate the effects of REDHAT-BUG-2041417.

Is REDHAT-BUG-2041417 a result of improper input validation?

Yes, REDHAT-BUG-2041417 is caused by the failure of the StringBuffer and StringBuilder classes to properly validate the count attribute during object deserialization.