REDHAT-BUG-2557757: Medium severity Oracle Java SE vulnerability
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to attempt exploitation?
An attacker can be unauthenticated and use network access through multiple protocols. No user interaction is required, but exploitation is rated difficult with high attack complexity.
What application designs are most exposed?
Exposure requires an attacker to be able to supply data to APIs in the Compiler component, for example through a web service. The issue is not exploitable through untrusted Java Web Start applications or untrusted Java applets.
Which Java SE releases are identified as affected?
The affected supported Oracle Java SE versions are 21.0.12.1, 25.0.4.1, and 27.
What could a successful attack allow?
A successful attack could allow unauthorized update, insert, or delete access to some Java SE-accessible data, and unauthorized read access to a subset of that data. Availability impact is not identified in the supplied CVSS vector.