CVE-2024-21235

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

A moderate severity vulnerability was found in the Hotspot component of OpenJDK as shipped in Red Hat Enterprise Linux, the Red Hat Build of OpenJDK, and Red Hat services that bundle OpenJDK. An integer conversion error causes an int to long conversion to be performed on signed values that are then used as unsigned; the resulting value can exceed the expected range and incorrectly allow range check elimination in the JVM. This difficult-to-exploit flaw allows an unauthenticated attacker with network access, for example through a web service that supplies data to the affected APIs, to gain unauthorized read, update, insert, or delete access to a subset of Java-accessible data; it can also affect Java deployments, such as clients running sandboxed Java Web Start applications or applets, that load and run untrusted code and rely on the Java sandbox for security. Red Hat rated this flaw Moderate (CVSS 4.8, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), matching the upstream severity. Within Red Hat Enterprise Linux, the java-1.8.0-openjdk, java-1.8.0-ibm, java-11-openjdk, java-17-openjdk, and java-21-openjdk components are affected across maintained RHEL 7, 8, and 9 streams; for these delegated components the fix is pursued through the upstream OpenJDK maintenance streams. On some RHEL 9 java-1.8.0-openjdk streams the fix is deferred, so those deployments retain the residual risk of this difficult-to-exploit issue until a fix is delivered. The Red Hat Build of OpenJDK and affected Red Hat cloud services likewise receive the fix through their respective update streams. RHEL 10 java-21-openjdk is not affected because the vulnerable code is not present in that build. The legacy java-1.6.0-openjdk and java-1.7.0-openjdk components on RHEL 6 and RHEL 7 ELS are out of support and do not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. For affected product streams where updated packages containing the fix have been released, apply the latest available OpenJDK package updates.