CVE-2024-21208

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

An availability-only vulnerability was found in the Java HTTP client. The JDK HTTP/2 client did not limit the size of the response headers it was prepared to accept, so an unauthenticated remote attacker with network access via multiple protocols, for example through a malicious or compromised server responding to requests made by the vulnerable client, could make the client accept excessively large headers and cause a partial denial of service of the Java application. Exploitation is difficult and only availability is impacted (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, base score 3.7). While the CVSS base score of 3.7 is rated Low severity because of the high attack complexity and low availability-only impact, this flaw is rated with Moderate impact by Red Hat. The java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk and java-21-openjdk packages in Red Hat Enterprise Linux 7, 8 and 9, the java-1.8.0-ibm packages in Red Hat Enterprise Linux 7 and 8, OpenJDK in the Red Hat Build of OpenJDK, and OpenJDK used by Red Hat services such as Insights and cost management are affected, and fixes for these streams are being pursued through Red Hat errata updates. For several Red Hat Enterprise Linux 9 java-1.8.0-openjdk streams the fix is deferred; the residual risk is limited to the difficult-to-exploit, availability-only client-side denial of service described above. Red Hat Enterprise Linux 10 is not affected because the java-21-openjdk package in that release does not contain the vulnerable code, and the legacy java-1.6.0-openjdk, java-1.7.0-openjdk and RHEL 6 java-1.8.0-openjdk streams are out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Fixes for the affected products are being pursued through Red Hat errata updates; apply the available OpenJDK updates for your affected streams.