PT-2021-1873 · Eclipse+4 · Eclipse Openj9+4
Peter Shipton
·
Published
2021-01-21
·
Updated
2021-03-15
·
CVE-2020-27221
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Eclipse OpenJ9 versions up to and including 0.23
Description
The issue is related to errors in handling UTF-8 encoded data. It may allow a remote attacker to execute arbitrary code. The problem occurs when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding, potentially leading to a stack-based buffer overflow.
Recommendations
For Eclipse OpenJ9 versions up to and including 0.23, consider disabling the UTF-8 conversion functionality until a patch is available.
Restrict access to the virtual machine or JNI natives to minimize the risk of exploitation.
Avoid using the
UTF-8 encoding in the affected virtual machine or JNI natives until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centos
Eclipse Openj9
Ibm Aix
Red Hat
Suse