CVE-2024-20919: Medium severity Oracle GraalVM vulnerability
A flaw was found in the way the Hotspot JVM class file verifier verified the correctness of bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Other sources
An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high integrity impact.
— IBM
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20919?
CVE-2024-20919 has a critical severity rating due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2024-20919?
To resolve CVE-2024-20919, update to the latest patched version of the affected software, such as OpenJDK or Oracle JDK.
Which software is affected by CVE-2024-20919?
CVE-2024-20919 impacts various versions of IBM Cognos Controller and multiple OpenJDK releases, including Oracle GraalVM.
What types of systems are vulnerable to CVE-2024-20919?
Systems running untrusted Java applications or applets, particularly those with vulnerable versions of Java SE, are susceptible to CVE-2024-20919.
Is there a workaround for CVE-2024-20919?
There is no verified workaround for CVE-2024-20919; updating to the latest versions is strongly recommended.