CVE-2024-21094

Published: 16 April 2024

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Priority

Cvss 3 Severity Score

3.7

Score breakdown

Status

Package	Release	Status
openjdk-13 Launchpad, Ubuntu, Debian	focal	Ignored (superseded by openjdk-17)
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
openjdk-16 Launchpad, Ubuntu, Debian	focal	Ignored (superseded by openjdk-17)
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
openjdk-17 Launchpad, Ubuntu, Debian	bionic	Released (17.0.11+9-1~18.04.1) Available with Ubuntu Pro
	focal	Released (17.0.11+9-1~20.04.2)
	jammy	Released (17.0.11+9-1~22.04.1)
	mantic	Released (17.0.11+9-1~23.10.1)
	noble	Not vulnerable (17.0.11+9-1)
	upstream	Needs triage
	Patches: upstream: https://github.com/openjdk/jdk17u/commit/5ed19267f63e0dde4f8ea41f4832237b980b3480
openjdk-18 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Ignored (superseded by openjdk-19)
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
openjdk-19 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Ignored (no longer supported by upstream)
	mantic	Ignored (end of life, was ignored [superseded by openjdk-20])
	noble	Does not exist
	upstream	Needs triage
openjdk-20 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Ignored (end of life, was ignored [superseded by openjdk-21])
	noble	Does not exist
	upstream	Needs triage
openjdk-21 Launchpad, Ubuntu, Debian	focal	Released (21.0.3+9-1ubuntu1~20.04.1)
	jammy	Released (21.0.3+9-1ubuntu1~22.04.1)
	mantic	Released (21.0.3+9-1ubuntu1~23.10.1)
	noble	Not vulnerable (21.0.3+9-1)
	upstream	Needs triage
	Patches: upstream: https://github.com/openjdk/jdk21u/commit/c9520790be2f90062f71bdea86a10909b1b0f11c
openjdk-22 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Ignored (end of life, was needed)
	upstream	Needs triage
	Patches: upstream: https://github.com/openjdk/jdk22u/commit/a5818972c16bd883d768ff2fb23a8aa9e0142c65
openjdk-8 Launchpad, Ubuntu, Debian	bionic	Released (8u412-ga-1~18.04.1) Available with Ubuntu Pro
	focal	Released (8u412-ga-1~20.04.1)
	jammy	Released (8u412-ga-1~22.04.1)
	mantic	Released (8u412-ga-1~23.10.1)
	noble	Released (8u412-ga-1~24.04.2)
	upstream	Needs triage
	xenial	Needed
	Patches: upstream: https://github.com/openjdk/jdk8u/commit/43cb87550865a93c559c9e8eaa59fcb071301bd3
openjdk-9 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	xenial	Ignored (no longer supported by upstream)
openjdk-lts Launchpad, Ubuntu, Debian	bionic	Released (11.0.23+9-1ubuntu1~18.04.1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	focal	Released (11.0.23+9-1ubuntu1~20.04.2)
	jammy	Released (11.0.23+9-1ubuntu1~22.04.1)
	mantic	Released (11.0.23+9-1ubuntu1~23.10.1)
	noble	Not vulnerable (11.0.23+9-1ubuntu1)
	upstream	Needs triage
	Patches: upstream: https://github.com/openjdk/jdk11u/commit/c6b1d04179afe49071cd2bc4d29ec90d26124867

Severity score breakdown

Parameter	Value
Base score	3.7
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›