PT-2019-5411 · Eclipse+4 · Eclipse Openj9+4
Peter Shipton
·
Published
2019-10-17
·
Updated
2020-10-16
·
CVE-2019-17631
CVSS v3.1
9.4
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Eclipse OpenJ9 versions 0.15 through 0.16
Description
The issue is related to errors in access control to diagnostic operations in the Eclipse OpenJ9 virtual machine. This could allow a remote attacker to elevate their privileges. The vulnerability may also cause a denial of service, resulting in low availability impact.
Recommendations
For Eclipse OpenJ9 versions 0.15 through 0.16, consider restricting access to diagnostic operations such as causing a GC or creating a diagnostic file until a patch is available. As a temporary workaround, implement privilege checks for these operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Incorrect Permission
Improper Authorization
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centos
Eclipse Openj9
Ibm Aix
Red Hat
Suse