cnvd - cnvd-2025-10396

cnvd-2025-10396

Vulnerability from cnvd

Title: IBM Semeru Runtime拒绝服务漏洞

Description:

IBM Semeru Runtime是IBM提供的开源Java运行时环境，基于Eclipse Adoptium项目，支持多种操作系统和架构，为Java应用程序提供高性能和高可靠性的运行平台。

IBM Semeru Runtime存在拒绝服务漏洞，该漏洞是由于AES/CBC加密实现中存在缺陷，当进行加密操作时，发生缓冲区溢出。攻击者可利用该漏洞导致受影响的应用程序崩溃，从而引发拒绝服务。

Severity: 高

Patch Name: IBM Semeru Runtime拒绝服务漏洞的补丁

Patch Description:

IBM Semeru Runtime是IBM提供的开源Java运行时环境，基于Eclipse Adoptium项目，支持多种操作系统和架构，为Java应用程序提供高性能和高可靠性的运行平台。

IBM Semeru Runtime存在拒绝服务漏洞，该漏洞是由于AES/CBC加密实现中存在缺陷，当进行加密操作时，发生缓冲区溢出。攻击者可利用该漏洞导致受影响的应用程序崩溃，从而引发拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://developer.ibm.com/languages/java/semeru-runtimes/downloads/

Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-2900

Impacted products

Name
['IBM IBM Semeru Runtime >=8.0.302.0，<=8.0.442.0', 'IBM IBM Semeru Runtime >=17.0.0.0，<=17.0.14.0', 'IBM IBM Semeru Runtime >=21.0.0.0，<=12.0.6.0', 'IBM IBM Semeru Runtime >=11.0.12.0，<=11.0.26.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-2900",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-2900"
    }
  },
  "description": "IBM Semeru Runtime\u662fIBM\u63d0\u4f9b\u7684\u5f00\u6e90Java\u8fd0\u884c\u65f6\u73af\u5883\uff0c\u57fa\u4e8eEclipse Adoptium\u9879\u76ee\uff0c\u652f\u6301\u591a\u79cd\u64cd\u4f5c\u7cfb\u7edf\u548c\u67b6\u6784\uff0c\u4e3aJava\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u9ad8\u6027\u80fd\u548c\u9ad8\u53ef\u9760\u6027\u7684\u8fd0\u884c\u5e73\u53f0\u3002\n\nIBM Semeru Runtime\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eAES/CBC\u52a0\u5bc6\u5b9e\u73b0\u4e2d\u5b58\u5728\u7f3a\u9677\uff0c\u5f53\u8fdb\u884c\u52a0\u5bc6\u64cd\u4f5c\u65f6\uff0c\u53d1\u751f\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\uff0c\u4ece\u800c\u5f15\u53d1\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://developer.ibm.com/languages/java/semeru-runtimes/downloads/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-10396",
  "openTime": "2025-05-19",
  "patchDescription": "IBM Semeru Runtime\u662fIBM\u63d0\u4f9b\u7684\u5f00\u6e90Java\u8fd0\u884c\u65f6\u73af\u5883\uff0c\u57fa\u4e8eEclipse Adoptium\u9879\u76ee\uff0c\u652f\u6301\u591a\u79cd\u64cd\u4f5c\u7cfb\u7edf\u548c\u67b6\u6784\uff0c\u4e3aJava\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u9ad8\u6027\u80fd\u548c\u9ad8\u53ef\u9760\u6027\u7684\u8fd0\u884c\u5e73\u53f0\u3002\r\n\r\nIBM Semeru Runtime\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eAES/CBC\u52a0\u5bc6\u5b9e\u73b0\u4e2d\u5b58\u5728\u7f3a\u9677\uff0c\u5f53\u8fdb\u884c\u52a0\u5bc6\u64cd\u4f5c\u65f6\uff0c\u53d1\u751f\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\uff0c\u4ece\u800c\u5f15\u53d1\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Semeru Runtime\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM IBM Semeru Runtime \u003e=8.0.302.0\uff0c\u003c=8.0.442.0",
      "IBM IBM Semeru Runtime \u003e=17.0.0.0\uff0c\u003c=17.0.14.0",
      "IBM IBM Semeru Runtime \u003e=21.0.0.0\uff0c\u003c=12.0.6.0",
      "IBM IBM Semeru Runtime \u003e=11.0.12.0\uff0c\u003c=11.0.26.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-2900",
  "serverity": "\u9ad8",
  "submitTime": "2025-05-16",
  "title": "IBM Semeru Runtime\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2025-2900 (GCVE-0-2025-2900)

Vulnerability from cvelistv5

Published

2025-05-14 18:50

Modified

2025-08-28 14:12

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Summary

IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused by a buffer overflow and subsequent crash, due to a defect in its native AES/CBC encryption implementation.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/7233415	vendor-advisory, patch

Impacted products

	Vendor	Product	Version
	IBM	Semeru Runtime	Version: 8.0.302.0 ≤ 8.0.442.0 Version: 11.0.12.0 ≤ 11.0.26.0 Version: 17.0.0.0 ≤ 17.0.14.0 Version: 21.0.0.0 ≤ 21.0.6.0 cpe:2.3:a:ibm:semeru_runtime:8.0.302.0:::::::* cpe:2.3:a:ibm:semeru_runtime:8.0.442.0:::::::* cpe:2.3:a:ibm:semeru_runtime:11.0.12.0:::::::* cpe:2.3:a:ibm:semeru_runtime:11.0.26.0:::::::* cpe:2.3:a:ibm:semeru_runtime:17.0.0.0:::::::* cpe:2.3:a:ibm:semeru_runtime:17.0.14.0:::::::* cpe:2.3:a:ibm:semeru_runtime:21.0.0.0:::::::* cpe:2.3:a:ibm:semeru_runtime:21.0.6.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2900",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-14T19:42:43.060744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-14T19:43:19.127Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:semeru_runtime:8.0.302.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:semeru_runtime:8.0.442.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:semeru_runtime:11.0.12.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:semeru_runtime:11.0.26.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:semeru_runtime:17.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:semeru_runtime:17.0.14.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:semeru_runtime:21.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:semeru_runtime:21.0.6.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Semeru Runtime",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "8.0.442.0",
              "status": "affected",
              "version": "8.0.302.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.0.26.0",
              "status": "affected",
              "version": "11.0.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "17.0.14.0",
              "status": "affected",
              "version": "17.0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "21.0.6.0",
              "status": "affected",
              "version": "21.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused by a buffer overflow and subsequent crash, due to a defect in its native AES/CBC encryption implementation."
            }
          ],
          "value": "IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused by a buffer overflow and subsequent crash, due to a defect in its native AES/CBC encryption implementation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-28T14:12:21.020Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7233415"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Remediation/Fixes\u003cbr\u003e\u003cbr\u003e8.0.452.0\u003cbr\u003e11.0.27.0\u003cbr\u003e17.0.15.0\u003cbr\u003e21.0.7.0\u003cbr\u003e\u003cbr\u003eIBM Semeru Runtime releases can be downloaded from the GitHub repositories for Semeru 8, Semeru 11, Semeru 17, and Semeru 21 and from the IBM Semeru Developer Center.\u003cbr\u003e\u003cbr\u003eIBM customers requiring an update for an SDK shipped with an IBM product should contact IBM support, and/or refer to the appropriate product security bulletin.\u003cbr\u003e"
            }
          ],
          "value": "Remediation/Fixes\n\n8.0.452.0\n11.0.27.0\n17.0.15.0\n21.0.7.0\n\nIBM Semeru Runtime releases can be downloaded from the GitHub repositories for Semeru 8, Semeru 11, Semeru 17, and Semeru 21 and from the IBM Semeru Developer Center.\n\nIBM customers requiring an update for an SDK shipped with an IBM product should contact IBM support, and/or refer to the appropriate product security bulletin."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Semeru Runtime denial of service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-2900",
    "datePublished": "2025-05-14T18:50:27.327Z",
    "dateReserved": "2025-03-28T02:06:38.367Z",
    "dateUpdated": "2025-08-28T14:12:21.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted