CVE-2024-20955

Опубликовано: 16 янв. 2024

Источник: nvd

CVSS3: 3.7

EPSS Низкий

Описание

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Ссылки

https://www.oracle.com/security-alerts/cpujan2024.html
Patch
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2024.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oracle:graalvm:20.3.12:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm:21.3.8:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm:22.3.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm_for_jdk:17.0.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:graalvm_for_jdk:21.0.1:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00508

Низкий

3.7 Low

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-200

Связанные уязвимости

GHSA-qfqc-q85j-6m33

CVSS3: 3.7

github

около 2 лет назад

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

BDU:2024-01062

CVSS3: 3.7

fstec

около 2 лет назад

Уязвимость компонента Compiler виртуальных машин Oracle GraalVM for JDK и Oracle GraalVM Enterprise Edition, позволяющая нарушителю раскрыть защищаемую информацию

EPSS

Процентиль: 66%

0.00508

Низкий

3.7 Low

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-200