Medium severity · published Nov 11, 2024
CVE-2024-10917
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openj9 · Eclipse
0.8.0 before 0.48.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10917
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10917
Issue Tracking
https://github.com/eclipse-openj9/openj9/pull/20362
Release Notes
https://github.com/eclipse-openj9/openj9/releases/tag/openj9-0.48.0
Issue Tracking
https://gitlab.eclipse.org/security/cve-assignement/-/issues/47
More from Openj9
9.8
CVE-2021-41035
In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods
9.8
CVE-2020-27221
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8…
9.8
CVE-2019-11772
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in…
9.8
CVE-2018-12549
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it
9.8
CVE-2018-12547
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter