CVE-2019-2684

MEDIUM

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

References

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html

http://www.openwall.com/lists/oss-security/2020/09/01/4

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

https://access.redhat.com/errata/RHBA-2019:0959

https://access.redhat.com/errata/RHSA-2019:1146

https://access.redhat.com/errata/RHSA-2019:1163

https://access.redhat.com/errata/RHSA-2019:1164

https://access.redhat.com/errata/RHSA-2019:1165

https://access.redhat.com/errata/RHSA-2019:1166

https://access.redhat.com/errata/RHSA-2019:1238

https://access.redhat.com/errata/RHSA-2019:1325

https://access.redhat.com/errata/RHSA-2019:1518

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cannounce.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cusers.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cannounce.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cuser.cassandra.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cuser.cassandra.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cuser.cassandra.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.cassandra.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cuser.cassandra.apache.org%3E

https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html

https://seclists.org/bugtraq/2019/May/75

https://security.gentoo.org/glsa/201908-10

https://support.f5.com/csp/article/K11175903?utm_source=f5support&utm_medium=RSS

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us

https://usn.ubuntu.com/3975-1/

https://www.debian.org/security/2019/dsa-4453

Details

Source: MITRE

Published: 2019-04-23

Updated: 2020-09-11

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Impact Score: 3.6

Exploitability Score: 2.2

Severity: MEDIUM

Tenable Plugins

View all (70 total)

IDNameProductFamilySeverity
145656CentOS 8 : java-11-openjdk (CESA-2019:1518)NessusCentOS Local Security Checks
medium
144543Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2019-0774)NessusVirtuozzo Local Security Checks
medium
136333Photon OS 2.0: Openjdk11 PHSA-2020-2.0-0235NessusPhotonOS Local Security Checks
medium
136109Photon OS 1.0: Openjdk11 PHSA-2020-1.0-0290NessusPhotonOS Local Security Checks
medium
136100Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084NessusPhotonOS Local Security Checks
medium
129200EulerOS 2.0 SP3 : java-1.7.0-openjdk (EulerOS-SA-2019-2007)NessusHuawei Local Security Checks
medium
128826EulerOS 2.0 SP5 : java-1.7.0-openjdk (EulerOS-SA-2019-1903)NessusHuawei Local Security Checks
medium
128285Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2019-1269)NessusAmazon Linux Local Security Checks
medium
127959GLSA-201908-10 : Oracle JDK/JRE: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
127819Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2019-1266)NessusAmazon Linux Local Security Checks
medium
127592Oracle Linux 8 : java-11-openjdk (ELSA-2019-1518)NessusOracle Linux Local Security Checks
medium
127581Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2019-1146)NessusOracle Linux Local Security Checks
medium
127435NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0157)NessusNewStart CGSL Local Security Checks
medium
127429NewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0154)NessusNewStart CGSL Local Security Checks
medium
127314NewStart CGSL MAIN 4.06 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0093)NessusNewStart CGSL Local Security Checks
medium
127309NewStart CGSL MAIN 4.06 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0090)NessusNewStart CGSL Local Security Checks
medium
126924AIX Java Advisory : java_apr2019_advisory.asc (April 2019 CPU)NessusAIX Local Security Checks
medium
126872EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2019-1745)NessusHuawei Local Security Checks
medium
126440SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1211-2) (Spectre)NessusSuSE Local Security Checks
medium
126336SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-2)NessusSuSE Local Security Checks
medium
126167SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1644-1)NessusSuSE Local Security Checks
medium
126027RHEL 8 : java-11-openjdk (RHSA-2019:1518)NessusRed Hat Local Security Checks
medium
125900Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1228)NessusAmazon Linux Local Security Checks
medium
125756RHEL 6 : java-1.8.0-ibm (RHSA-2019:1325)NessusRed Hat Local Security Checks
medium
125698openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2019-1500)NessusSuSE Local Security Checks
medium
125676SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:1392-1)NessusSuSE Local Security Checks
medium
125608Debian DSA-4453-1 : openjdk-8 - security updateNessusDebian Local Security Checks
medium
125512EulerOS 2.0 SP3 : java-1.8.0-openjdk (EulerOS-SA-2019-1585)NessusHuawei Local Security Checks
medium
125461SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:1345-1)NessusSuSE Local Security Checks
medium
125451openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1439) (Spectre)NessusSuSE Local Security Checks
medium
125450openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1438) (Spectre)NessusSuSE Local Security Checks
medium
125336SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2019:14059-1)NessusSuSE Local Security Checks
medium
125335SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-1)NessusSuSE Local Security Checks
medium
125288Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2019-1209)NessusAmazon Linux Local Security Checks
medium
125239RHEL 8 : java-1.8.0-ibm (RHSA-2019:1238)NessusRed Hat Local Security Checks
high
125028Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : OpenJDK vulnerabilities (USN-3975-1)NessusUbuntu Local Security Checks
medium
125023SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1219-1) (Spectre)NessusSuSE Local Security Checks
medium
125015RHEL 7 : java-1.7.1-ibm (RHSA-2019:1166)NessusRed Hat Local Security Checks
medium
125014RHEL 6 : java-1.7.1-ibm (RHSA-2019:1165)NessusRed Hat Local Security Checks
medium
125013RHEL 7 : java-1.8.0-ibm (RHSA-2019:1164)NessusRed Hat Local Security Checks
medium
125012RHEL 6 : java-1.8.0-ibm (RHSA-2019:1163)NessusRed Hat Local Security Checks
medium
124857SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1211-1) (Spectre)NessusSuSE Local Security Checks
medium
124847RHEL 8 : java-1.8.0-openjdk (RHSA-2019:1146)NessusRed Hat Local Security Checks
medium
124777Debian DLA-1782-1 : openjdk-7 security updateNessusDebian Local Security Checks
medium
124642openSUSE Security Update : java-11-openjdk (openSUSE-2019-1327)NessusSuSE Local Security Checks
medium
700660Oracle Java SE 7 < Update 221 / 8 < Update 211 / 11 < Update 3 / 12 < Update 1 Multiple Vulnerabilities (Apr 2019 CPU)Nessus Network MonitorWeb Clients
high
124397EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2019-1301)NessusHuawei Local Security Checks
medium
124362SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2019:1052-1)NessusSuSE Local Security Checks
medium
124242CentOS 7 : java-1.7.0-openjdk (CESA-2019:0791)NessusCentOS Local Security Checks
medium
124241CentOS 6 : java-1.7.0-openjdk (CESA-2019:0790)NessusCentOS Local Security Checks
medium
124235Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20190422)NessusScientific Linux Local Security Checks
medium
124234Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20190422)NessusScientific Linux Local Security Checks
medium
124233RHEL 7 : java-1.7.0-openjdk (RHSA-2019:0791)NessusRed Hat Local Security Checks
medium
124232RHEL 6 : java-1.7.0-openjdk (RHSA-2019:0790)NessusRed Hat Local Security Checks
medium
124230Oracle Linux 7 : java-1.7.0-openjdk (ELSA-2019-0791)NessusOracle Linux Local Security Checks
medium
124229Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2019-0790)NessusOracle Linux Local Security Checks
medium
124203CentOS 7 : java-11-openjdk (CESA-2019:0778)NessusCentOS Local Security Checks
medium
124202CentOS 7 : java-1.8.0-openjdk (CESA-2019:0775)NessusCentOS Local Security Checks
medium
124201CentOS 6 : java-1.8.0-openjdk (CESA-2019:0774)NessusCentOS Local Security Checks
medium
124198Oracle Java SE 1.7.0_221 / 1.8.0_211 / 1.11.0_3 / 1.12.0_1 Multiple Vulnerabilities (Apr 2019 CPU)NessusWindows
medium
124197Oracle Java SE 1.7.0_221 / 1.8.0_211 / 1.11.0_3 / 1.12.0_1 Multiple Vulnerabilities (Apr 2019 CPU) (Unix)NessusMisc.
medium
124185Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20190417)NessusScientific Linux Local Security Checks
medium
124184Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20190417)NessusScientific Linux Local Security Checks
medium
124139Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20190417)NessusScientific Linux Local Security Checks
medium
124138RHEL 7 : java-11-openjdk (RHSA-2019:0778)NessusRed Hat Local Security Checks
medium
124137RHEL 7 : java-1.8.0-openjdk (RHSA-2019:0775)NessusRed Hat Local Security Checks
medium
124136RHEL 6 : java-1.8.0-openjdk (RHSA-2019:0774)NessusRed Hat Local Security Checks
medium
124135Oracle Linux 7 : java-11-openjdk (ELSA-2019-0778)NessusOracle Linux Local Security Checks
medium
124134Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2019-0775)NessusOracle Linux Local Security Checks
medium
124133Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-0774)NessusOracle Linux Local Security Checks
medium