Описание
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Отчет
An availability-only vulnerability was found in the Java HTTP client. The JDK HTTP/2 client did not limit the size of the response headers it was prepared to accept, so an unauthenticated remote attacker with network access via multiple protocols, for example through a malicious or compromised server responding to requests made by the vulnerable client, could make the client accept excessively large headers and cause a partial denial of service of the Java application. Exploitation is difficult and only availability is impacted (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, base score 3.7). While the CVSS base score of 3.7 is rated Low severity because of the high attack complexity and low availability-only impact, this flaw is rated with Moderate impact by Red Hat. The java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk and java-21-openjdk packages in Red Hat Enterprise Linux 7, 8 and 9, the java-1.8.0-ibm packages in Red Hat Enterprise Linux 7 and 8, OpenJDK in the Red Hat Build of OpenJDK, and OpenJDK used by Red Hat services such as Insights and cost management are affected, and fixes for these streams are being pursued through Red Hat errata updates. For several Red Hat Enterprise Linux 9 java-1.8.0-openjdk streams the fix is deferred; the residual risk is limited to the difficult-to-exploit, availability-only client-side denial of service described above. Red Hat Enterprise Linux 10 is not affected because the java-21-openjdk package in that release does not contain the vulnerable code, and the legacy java-1.6.0-openjdk, java-1.7.0-openjdk and RHEL 6 java-1.8.0-openjdk streams are out of support scope.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Fixes for the affected products are being pursued through Red Hat errata updates; apply the available OpenJDK updates for your affected streams.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | java-21-openjdk | Not affected | ||
| Red Hat Enterprise Linux 6 | java-1.6.0-openjdk | Out of support scope | ||
| Red Hat Enterprise Linux 6 | java-1.7.0-openjdk | Out of support scope | ||
| Red Hat Enterprise Linux 6 | java-1.8.0-openjdk | Out of support scope | ||
| Red Hat Enterprise Linux 7 | java-1.6.0-openjdk | Out of support scope | ||
| Red Hat Enterprise Linux 7 | java-1.7.0-openjdk | Out of support scope | ||
| Red Hat Enterprise Linux 7 | java-1.8.0-ibm | Out of support scope | ||
| Red Hat Build of OpenJDK 11.0.25 | portable-linux | Fixed | RHSA-2024:8122 | 16.10.2024 |
| Red Hat Build of OpenJDK 11.0.25 | windows | Fixed | RHSA-2024:8123 | 16.10.2024 |
| Red Hat Build of OpenJDK 17.0.13 | portable-linux | Fixed | RHSA-2024:8125 | 16.10.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the J
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on th...
Уязвимость компонентов Diagnostics виртуальных машин Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK и программной платформы Oracle Java SE, позволяющая нарушителю вызвать частичный отказ в обслуживании (DOS)
EPSS
3.7 Low
CVSS3