CVE-2024-21217 — Deserialization of Untrusted Data in Corporation Oracle Java SE

CWE-502 — Deserialization of Untrusted DataCWE-789 — Memory Allocation with Excessive Size Value21 documents8 sources
Severity
3.7LOWNVD
EPSS
0.1%
top 73.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Oracle Corporation Oracle Java SEOracle GraalvmOracle Graalvm FOR JDK+2 more
Timeline
PublishedOct 15
Latest updateMar 11

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Orac…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 2.2 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5oracle_corporation/oracle_java_se11 versions+10
▶NVDoracle/graalvm5 versions+4
▶NVDoracle/jdk5 versions+4
▶NVDoracle/jre5 versions+4

🔴Vulnerability Details

10
OSV
openjdk-21-crac vulnerabilities↗2025-03-11
▶
OSV
openjdk-17-crac vulnerabilities↗2025-03-11
▶
OSV
openjdk-23 vulnerabilities↗2024-11-24
▶
OSV
openjdk-17 vulnerabilities↗2024-11-11
▶
OSV
openjdk-lts vulnerabilities↗2024-11-11
▶

📋Vendor Advisories

10
Ubuntu
CRaC JDK 17 vulnerabilities↗2025-03-11
▶
Ubuntu
CRaC JDK 21 vulnerabilities↗2025-03-11
▶
Ubuntu
OpenJDK 23 vulnerabilities↗2024-11-24
▶
Ubuntu
OpenJDK 11 vulnerabilities↗2024-11-11
▶
Ubuntu
OpenJDK 8 vulnerabilities↗2024-11-11
▶
CVE-2024-21217 — Deserialization of Untrusted Data | cvebase