CVE-2024-21085: Low severity NetApp Active Iq Unified Manager Vmware Vsphere vulnerability
A flaw was found in the Pack200 archive format in OpenJDK. The NativeUnpack class did not properly validate the memory size when allocating a buffer, potentially leading to an excessive memory allocation and denial of service condition.
Other sources
An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impacts.
— IBM
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21085?
CVE-2024-21085 has been classified with a moderate severity level due to its potential to cause denial of service.
How do I fix CVE-2024-21085?
To remediate CVE-2024-21085, update OpenJDK to versions 11.0.24+8-2~deb11u1 or later for OpenJDK 11, or 8u432-b06-2 or later for OpenJDK 8.
Which software is affected by CVE-2024-21085?
CVE-2024-21085 affects OpenJDK 8 and OpenJDK 11, as well as IBM's Storage Protect Backup-Archive Client versions up to 8.1.23.0.
What type of vulnerability is CVE-2024-21085?
CVE-2024-21085 is a denial of service vulnerability caused by improper memory allocation in the Pack200 archive format of OpenJDK.
Is CVE-2024-21085 a known exploit?
As of now, there is no publicly disclosed exploit for CVE-2024-21085, though it presents a risk of denial of service.