CVE-2024-20952

CWE-284 — Improper Access ControlCWE-416 — Use After FreeCWE-38513 documents9 sources
Severity
7.4HIGH
EPSS
0.3%
top 44.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Oracle OpenjdkOracle Corporation Java SE JDK AND JREDebian Debian Linux+4 more
Timeline
PublishedJan 16
Latest updateNov 11

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle Graal…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages8 packages

▶NVDoracle/graalvm5 versions+4
▶NVDoracle/openjdk11 — 11.0.24+3
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre4 versions+3

Also affects: Debian Linux 10.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-343v-9ccv-7535: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)↗2024-01-17
▶
OSV
CVE-2024-20952: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)↗2024-01-16
▶
CVEList
CVE-2024-20952: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)↗2024-01-16
▶

📋Vendor Advisories

9
Ubuntu
OpenJDK 8 vulnerabilities↗2024-11-11
▶
Atlassian
CVE-2023-22025 CVE-2023-22081 CVE-2024-20918 CVE-2024-20919 CVE-2024-20921 CVE-2024-20926 CVE-2024-20932 CVE-2024-20945↗2024-07-16
▶
Ubuntu
OpenJDK 8 vulnerabilities↗2024-03-18
▶
Ubuntu
OpenJDK 21 vulnerabilities↗2024-02-27
▶
Ubuntu
OpenJDK 11 vulnerabilities↗2024-02-27
▶
CVE-2024-20952 (HIGH CVSS 7.4) | Vulnerability in the Oracle Java SE | cvebase.io