Vulnerability-Lookup

CNVD-2019-38824

Vulnerability from cnvd - Published: 2019-11-03

Title

Oracle GraalVM Enterprise Edition存在未明漏洞（CNVD-2019-38824）

Description

Oracle GraalVM是美国甲骨文（Oracle）公司的一套使用Java语言编写的即时编译器。该产品支持多种编程语言和执行模式。GraalVM Enterprise Edition是GraalVM的企业版。 Oracle GraalVM Enterprise Edition存在未明漏洞。攻击者可利用该漏洞未授权创建、删除或修改数据，影响数据的完整性。

Severity

中

Patch Name

Oracle GraalVM Enterprise Edition存在未明漏洞（CNVD-2019-38824）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-2989

Impacted products

Name
Oracle Oracle GraalVM Enterprise Edition 19.2.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-2989",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-2989"
    }
  },
  "description": "Oracle GraalVM\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u4f7f\u7528Java\u8bed\u8a00\u7f16\u5199\u7684\u5373\u65f6\u7f16\u8bd1\u5668\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u591a\u79cd\u7f16\u7a0b\u8bed\u8a00\u548c\u6267\u884c\u6a21\u5f0f\u3002GraalVM Enterprise Edition\u662fGraalVM\u7684\u4f01\u4e1a\u7248\u3002\n\nOracle GraalVM Enterprise Edition\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u521b\u5efa\u3001\u5220\u9664\u6216\u4fee\u6539\u6570\u636e\uff0c\u5f71\u54cd\u6570\u636e\u7684\u5b8c\u6574\u6027\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-38824",
  "openTime": "2019-11-03",
  "patchDescription": "Oracle GraalVM\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u4f7f\u7528Java\u8bed\u8a00\u7f16\u5199\u7684\u5373\u65f6\u7f16\u8bd1\u5668\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u591a\u79cd\u7f16\u7a0b\u8bed\u8a00\u548c\u6267\u884c\u6a21\u5f0f\u3002GraalVM Enterprise Edition\u662fGraalVM\u7684\u4f01\u4e1a\u7248\u3002\r\n\r\nOracle GraalVM Enterprise Edition\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u521b\u5efa\u3001\u5220\u9664\u6216\u4fee\u6539\u6570\u636e\uff0c\u5f71\u54cd\u6570\u636e\u7684\u5b8c\u6574\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle GraalVM Enterprise Edition\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2019-38824\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Oracle Oracle GraalVM Enterprise Edition 19.2.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-2989",
  "serverity": "\u4e2d",
  "submitTime": "2019-10-16",
  "title": "Oracle GraalVM Enterprise Edition\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2019-38824\uff09"
}

CVE-2019-2989 (GCVE-0-2019-2989)

Vulnerability from cvelistv5 – Published: 2019-10-16 17:40 – Updated: 2024-10-01 16:24

Summary

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-01 16:13 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.

Assigner

oracle mitre root

References

23 references

URL	Tags
http://www.oracle.com/technetwork/security-adviso…	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:3134	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3135	vendor-advisoryx_refsource_REDHAT
https://security.netapp.com/advisory/ntap-2019101…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:3136	vendor-advisoryx_refsource_REDHAT
https://www.debian.org/security/2019/dsa-4546	vendor-advisoryx_refsource_DEBIAN
https://seclists.org/bugtraq/2019/Oct/27	mailing-listx_refsource_BUGTRAQ
https://seclists.org/bugtraq/2019/Oct/31	mailing-listx_refsource_BUGTRAQ
https://www.debian.org/security/2019/dsa-4548	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2019:3157	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3158	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:4110	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:4109	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2019:4113	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:4115	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://usn.ubuntu.com/4223-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2020:0006	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0046	vendor-advisoryx_refsource_REDHAT
https://kc.mcafee.com/corporate/index?page=conten…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Java	Affected: Java SE: 7u231, 8u221, 11.0.4, 13 Affected: Java SE Embedded: 8u221

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:12:08.391Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "name": "RHSA-2019:3134",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3134"
          },
          {
            "name": "RHSA-2019:3135",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3135"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191017-0001/"
          },
          {
            "name": "RHSA-2019:3136",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3136"
          },
          {
            "name": "DSA-4546",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4546"
          },
          {
            "name": "20191021 [SECURITY] [DSA 4548-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Oct/27"
          },
          {
            "name": "20191021 [SECURITY] [DSA 4546-1] openjdk-11 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Oct/31"
          },
          {
            "name": "DSA-4548",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4548"
          },
          {
            "name": "RHSA-2019:3157",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3157"
          },
          {
            "name": "RHSA-2019:3158",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3158"
          },
          {
            "name": "openSUSE-SU-2019:2557",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html"
          },
          {
            "name": "openSUSE-SU-2019:2565",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html"
          },
          {
            "name": "RHSA-2019:4110",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:4110"
          },
          {
            "name": "RHSA-2019:4109",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:4109"
          },
          {
            "name": "[debian-lts-announce] 20191207 [SECURITY] [DLA 2023-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00005.html"
          },
          {
            "name": "RHSA-2019:4113",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:4113"
          },
          {
            "name": "RHSA-2019:4115",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:4115"
          },
          {
            "name": "openSUSE-SU-2019:2687",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html"
          },
          {
            "name": "USN-4223-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4223-1/"
          },
          {
            "name": "RHSA-2020:0006",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0006"
          },
          {
            "name": "RHSA-2020:0046",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0046"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-2989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T16:13:42.524322Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T16:24:49.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u231, 8u221, 11.0.4, 13"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u221"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via  multiple protocols to compromise Java SE, Java SE Embedded.  While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-13T07:06:15.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        },
        {
          "name": "RHSA-2019:3134",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3134"
        },
        {
          "name": "RHSA-2019:3135",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3135"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20191017-0001/"
        },
        {
          "name": "RHSA-2019:3136",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3136"
        },
        {
          "name": "DSA-4546",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4546"
        },
        {
          "name": "20191021 [SECURITY] [DSA 4548-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Oct/27"
        },
        {
          "name": "20191021 [SECURITY] [DSA 4546-1] openjdk-11 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Oct/31"
        },
        {
          "name": "DSA-4548",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4548"
        },
        {
          "name": "RHSA-2019:3157",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3157"
        },
        {
          "name": "RHSA-2019:3158",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3158"
        },
        {
          "name": "openSUSE-SU-2019:2557",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html"
        },
        {
          "name": "openSUSE-SU-2019:2565",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html"
        },
        {
          "name": "RHSA-2019:4110",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:4110"
        },
        {
          "name": "RHSA-2019:4109",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:4109"
        },
        {
          "name": "[debian-lts-announce] 20191207 [SECURITY] [DLA 2023-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00005.html"
        },
        {
          "name": "RHSA-2019:4113",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:4113"
        },
        {
          "name": "RHSA-2019:4115",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:4115"
        },
        {
          "name": "openSUSE-SU-2019:2687",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html"
        },
        {
          "name": "USN-4223-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4223-1/"
        },
        {
          "name": "RHSA-2020:0006",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0006"
        },
        {
          "name": "RHSA-2020:0046",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0046"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2019-2989",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u231, 8u221, 11.0.4, 13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u221"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via  multiple protocols to compromise Java SE, Java SE Embedded.  While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "refsource": "MISC",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            },
            {
              "name": "RHSA-2019:3134",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3134"
            },
            {
              "name": "RHSA-2019:3135",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3135"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20191017-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20191017-0001/"
            },
            {
              "name": "RHSA-2019:3136",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3136"
            },
            {
              "name": "DSA-4546",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4546"
            },
            {
              "name": "20191021 [SECURITY] [DSA 4548-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Oct/27"
            },
            {
              "name": "20191021 [SECURITY] [DSA 4546-1] openjdk-11 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Oct/31"
            },
            {
              "name": "DSA-4548",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4548"
            },
            {
              "name": "RHSA-2019:3157",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3157"
            },
            {
              "name": "RHSA-2019:3158",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3158"
            },
            {
              "name": "openSUSE-SU-2019:2557",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html"
            },
            {
              "name": "openSUSE-SU-2019:2565",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html"
            },
            {
              "name": "RHSA-2019:4110",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:4110"
            },
            {
              "name": "RHSA-2019:4109",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:4109"
            },
            {
              "name": "[debian-lts-announce] 20191207 [SECURITY] [DLA 2023-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00005.html"
            },
            {
              "name": "RHSA-2019:4113",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:4113"
            },
            {
              "name": "RHSA-2019:4115",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:4115"
            },
            {
              "name": "openSUSE-SU-2019:2687",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html"
            },
            {
              "name": "USN-4223-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4223-1/"
            },
            {
              "name": "RHSA-2020:0006",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0006"
            },
            {
              "name": "RHSA-2020:0046",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0046"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2019-2989",
    "datePublished": "2019-10-16T17:40:58.000Z",
    "dateReserved": "2018-12-14T00:00:00.000Z",
    "dateUpdated": "2024-10-01T16:24:49.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2019-38824

CVE-2019-2989 (GCVE-0-2019-2989)

Tags

Sightings

Nomenclature

Related by attack behaviour