CVE-2024-20919: Medium severity Oracle GraalVM vulnerability

Published Jan 11, 2024
·
Updated

A flaw was found in the way the Hotspot JVM class file verifier verified the correctness of bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Other sources

An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high integrity impact.

— IBM

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

— NVD

Affected Software

20 affected componentsFixes available
Oracle GraalVM=20.3.12
Oracle GraalVM=21.3.8
Oracle GraalVM=22.3.4
Oracle GraalVM for JDK=17.0.9
Oracle GraalVM for JDK=21.0.1
Oracle JDK=1.8.0-update391
Oracle JDK=1.8.0-update391
Oracle JDK=11.0.21
Oracle JDK=17.0.9
Oracle JDK=21.0.1
Oracle JRE=1.8.0-update391
Oracle JRE=1.8.0-update391
Oracle JRE=11.0.21
Oracle JRE=17.0.9
Oracle JRE=21.0.1
debian/openjdk-11
11.0.24+8-2~deb11u111.0.26+4-1~deb11u111.0.27+6-1
debian/openjdk-17
17.0.12+7-2~deb11u117.0.14+7-1~deb11u117.0.14+7-1~deb12u117.0.15+6-1~deb12u117.0.15~5ea-117.0.15+6-1
debian/openjdk-21
21.0.7~8ea-121.0.7+6-1
debian/openjdk-8
8u442-ga-2
IBM InfoSphere Data Architect<=9.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/openjdk-11 to a version that resolves this vulnerability.

    Fixed in 11.0.24+8-2~deb11u1Fixed in 11.0.26+4-1~deb11u1Fixed in 11.0.27+6-1
  2. Upgrade

    Upgrade debian/openjdk-17 to a version that resolves this vulnerability.

    Fixed in 17.0.12+7-2~deb11u1Fixed in 17.0.14+7-1~deb11u1Fixed in 17.0.14+7-1~deb12u1Fixed in 17.0.15+6-1~deb12u1Fixed in 17.0.15~5ea-1Fixed in 17.0.15+6-1
  3. Upgrade

    Upgrade debian/openjdk-21 to a version that resolves this vulnerability.

    Fixed in 21.0.7~8ea-1Fixed in 21.0.7+6-1
  4. Upgrade

    Upgrade debian/openjdk-8 to a version that resolves this vulnerability.

    Fixed in 8u442-ga-2
  5. Upgrade

    Upgrade Oracle Java SE 8u391/8u391-perf to a version that resolves this vulnerability.

    Fixed in 8u391
  6. Upgrade

    Upgrade Oracle Java SE 11.0.21 to a version that resolves this vulnerability.

    Fixed in 11.0.21
  7. Upgrade

    Upgrade Oracle Java SE 17.0.9 to a version that resolves this vulnerability.

    Fixed in 17.0.9
  8. Upgrade

    Upgrade Oracle Java SE 21.0.1 to a version that resolves this vulnerability.

    Fixed in 21.0.1
  9. Upgrade

    Upgrade Oracle GraalVM for JDK 17.0.9 to a version that resolves this vulnerability.

    Fixed in 17.0.9
  10. Upgrade

    Upgrade Oracle GraalVM for JDK 21.0.1 to a version that resolves this vulnerability.

    Fixed in 21.0.1
  11. Upgrade

    Upgrade Oracle GraalVM Enterprise Edition 20.3.12 to a version that resolves this vulnerability.

    Fixed in 20.3.12
  12. Upgrade

    Upgrade Oracle GraalVM Enterprise Edition 21.3.8 to a version that resolves this vulnerability.

    Fixed in 21.3.8
  13. Upgrade

    Upgrade Oracle GraalVM Enterprise Edition 22.3.4 to a version that resolves this vulnerability.

    Fixed in 22.3.4

Event History

Jan 11, 2024
Data Sourced
via Red Hat·10:24 AM
DescriptionSeverityAffected Software
Feb 17, 2024
CVE Published
via MITRE·01:50 AM
Data Sourced
via MITRE·01:50 AM
DescriptionSeverity
Data Sourced
via NVD·02:15 AM
DescriptionSeverityAffected Software
Mar 2, 2024
Data Sourced
via Launchpad·03:12 AM
Description
Nov 15, 2024
Data Sourced
via Ubuntu·05:44 AM
RemedyDescriptionSeverityAffected Software
Mar 4, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-20919?

CVE-2024-20919 has a critical severity rating due to its potential to bypass Java sandbox restrictions.

2

How do I fix CVE-2024-20919?

To resolve CVE-2024-20919, update to the latest patched version of the affected software, such as OpenJDK or Oracle JDK.

3

Which software is affected by CVE-2024-20919?

CVE-2024-20919 impacts various versions of IBM Cognos Controller and multiple OpenJDK releases, including Oracle GraalVM.

4

What types of systems are vulnerable to CVE-2024-20919?

Systems running untrusted Java applications or applets, particularly those with vulnerable versions of Java SE, are susceptible to CVE-2024-20919.

5

Is there a workaround for CVE-2024-20919?

There is no verified workaround for CVE-2024-20919; updating to the latest versions is strongly recommended.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203