In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade java-1.8.0-ibm-develUpgrade java-1.8.0-ibm-srcUpgrade java-1.8.0-ibm-webstartUpgrade java-1.8.0-ibm-demoUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.8.0-ibm-pluginUpgrade java-1.8.0-ibm-headlessUpgrade java-1.8.0-ibm | Oct 24, 2022 | Apr 27, 2022 |
| Ibm Aix | — | Apply the fix or workaround for java_dec2022_advisory | Jul 27, 2023 | Apr 27, 2022 |
| Ibm Java | — | Upgrade IBM Java to version 8.0.7.10 | Apr 27, 2022 | Apr 27, 2022 |
| Redhat_linux | — | Upgrade java-1.8.0-ibm-srcUpgrade java-1.8.0-ibm-webstartUpgrade java-1.8.0-ibm-demoUpgrade java-1.8.0-ibm-headlessUpgrade java-1.8.0-ibm-develUpgrade java-1.8.0-ibmUpgrade java-1.8.0-ibm-pluginUpgrade java-1.8.0-ibm-jdbc | Oct 24, 2022 | Apr 27, 2022 |
| Suse | — | Upgrade java-1_8_0-openj9-javadocUpgrade java-1_8_0-openj9-demoUpgrade java-1_8_0-openj9Upgrade java-1_8_0-openj9-develUpgrade java-1_8_0-openj9-accessibilityUpgrade java-1_8_0-openj9-srcUpgrade java-1_8_0-openj9-headless | Oct 26, 2022 | Apr 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub