CVE-2024-21217

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

A MODERATE impact denial-of-service vulnerability was found in the java.text.MessageFormat implementation in OpenJDK as shipped in Red Hat Enterprise Linux and the Red Hat Build of OpenJDK. MessageFormat did not impose an upper bound on the ArgumentIndex pattern element, and internal array allocation was sized from that untrusted value: supplying a crafted pattern with an arbitrarily large ArgumentIndex to the MessageFormat constructors, the applyPattern(String) method, or the static format(String, Object...) method, or deserializing a crafted MessageFormat object, can trigger an excessively large memory allocation that exhausts Java heap memory (out-of-memory error), resulting in a partial denial of service of the affected Java application. The vulnerability is difficult to exploit by an unauthenticated remote attacker and affects availability only; exploitation requires an application to pass attacker-controlled data to the affected APIs, for example through a web service that supplies data to those APIs. The java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, and java-21-openjdk components in Red Hat Enterprise Linux 7, 8, and 9, the Red Hat Build of OpenJDK 8, 11, 17, and 21, and Red Hat online services built on OpenJDK are affected, and a fix is being pursued for these products. Red Hat Enterprise Linux 10 is not affected because the vulnerable code is not present in its java-21-openjdk packages. Both Red Hat and the upstream rating assign a CVSS 3.1 base score of 3.7 (LOW severity, availability impact only), reflecting the difficult exploitation and limited consequence of this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. This issue can be addressed by installing the OpenJDK security updates provided by Red Hat for the affected products.