CVE-2024-20918

CWE-284 — Improper Access ControlCWE-787 — Out-of-bounds Write17 documents9 sources
Severity
7.4HIGH
EPSS
0.2%
top 53.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Oracle Corporation Java SE JDK AND JREDebian Debian LinuxOracle Graalvm+3 more
Timeline
PublishedJan 16
Latest updateNov 11

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalV…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages11 packages

▶NVDoracle/graalvm5 versions+4
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre4 versions+3
▶Ubuntuopenjdk-8< 8u402-ga-2ubuntu1~20.04+2

Also affects: Debian Linux 10.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

7
OSV
openjdk-8 vulnerabilities↗2024-03-18
▶
OSV
openjdk-lts vulnerabilities↗2024-02-27
▶
OSV
openjdk-17 vulnerabilities↗2024-02-27
▶
OSV
openjdk-21 vulnerabilities↗2024-02-27
▶
GHSA
GHSA-45pc-2866-5hxx: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)↗2024-01-17
▶

📋Vendor Advisories

9
Ubuntu
OpenJDK 8 vulnerabilities↗2024-11-11
▶
Atlassian
CVE-2023-22025 CVE-2023-22081 CVE-2024-20918 CVE-2024-20919 CVE-2024-20921 CVE-2024-20926 CVE-2024-20932 CVE-2024-20945↗2024-07-16
▶
Ubuntu
OpenJDK 8 vulnerabilities↗2024-03-18
▶
Ubuntu
OpenJDK 21 vulnerabilities↗2024-02-27
▶
Ubuntu
OpenJDK 11 vulnerabilities↗2024-02-27
▶
CVE-2024-20918 (HIGH CVSS 7.4) | Vulnerability in the Oracle Java SE | cvebase.io