REDHAT-BUG-2557236: Medium severity Oracle Java SE vulnerability
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and what access do they need?
An unauthenticated attacker needs network access via one or more protocols. Exploitation is rated difficult and requires the attacker to supply data to APIs in the JGSS component.
Are Java Web Start applications or applets an exploitation path?
No. The issue is exploitable without using untrusted Java Web Start applications or untrusted Java applets; a web service is given as an example of a path that can supply data to the affected APIs.
What is the likely impact of a successful attack?
A successful attack can allow unauthorized creation, deletion, or modification of critical data or of data accessible to the affected Java SE or GraalVM installation. The stated CVSS impact is integrity only; confidentiality and availability impacts are not listed.
Which releases are identified as affected?
Affected Oracle Java SE releases are 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27. Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1, are also identified as affected.