CVE-2019-2684

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
oracleCNA
---
---
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
VendorProductVersion
oraclejdk
1.7.0
oraclejdk
1.8.0
oraclejdk
1.8.0
oraclejdk
11.0.2
oraclejre
1.7.0
oraclejre
1.8.0
oraclejre
1.8.0
oraclejre
11.0.2
redhatopenshift_container_platform
3.11
redhatsatellite
5.8
redhatenterprise_linux
8.0
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_eus
8.1
redhatenterprise_linux_eus
8.2
redhatenterprise_linux_eus
8.4
redhatenterprise_linux_eus
8.6
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
8.2
redhatenterprise_linux_server_aus
8.4
redhatenterprise_linux_server_aus
8.6
redhatenterprise_linux_server_tus
8.2
redhatenterprise_linux_server_tus
8.4
redhatenterprise_linux_server_tus
8.6
redhatenterprise_linux_workstation
6.0
redhatenterprise_linux_workstation
7.0
opensuseleap
15.0
opensuseleap
42.3
debiandebian_linux
8.0
debiandebian_linux
9.0
apachecassandra
2.1.0 ≤
𝑥
< 2.1.22
apachecassandra
2.2.0 ≤
𝑥
< 2.2.18
apachecassandra
3.0.0 ≤
𝑥
< 3.0.22
apachecassandra
3.11.0 ≤
𝑥
< 3.11.8
apachecassandra
4.0.0:beta1
apachetomcat
7.0.0 ≤
𝑥
≤ 7.0.97
apachetomcat
8.5.0 ≤
𝑥
≤ 8.5.47
apachetomcat
9.0.1 ≤
𝑥
≤ 9.0.28
apachetomcat
9.0.0:milestone1
apachetomcat
9.0.0:milestone10
apachetomcat
9.0.0:milestone11
apachetomcat
9.0.0:milestone12
apachetomcat
9.0.0:milestone13
apachetomcat
9.0.0:milestone14
apachetomcat
9.0.0:milestone15
apachetomcat
9.0.0:milestone16
apachetomcat
9.0.0:milestone17
apachetomcat
9.0.0:milestone18
apachetomcat
9.0.0:milestone19
apachetomcat
9.0.0:milestone2
apachetomcat
9.0.0:milestone20
apachetomcat
9.0.0:milestone21
apachetomcat
9.0.0:milestone22
apachetomcat
9.0.0:milestone23
apachetomcat
9.0.0:milestone24
apachetomcat
9.0.0:milestone25
apachetomcat
9.0.0:milestone26
apachetomcat
9.0.0:milestone27
apachetomcat
9.0.0:milestone3
apachetomcat
9.0.0:milestone4
apachetomcat
9.0.0:milestone5
apachetomcat
9.0.0:milestone6
apachetomcat
9.0.0:milestone7
apachetomcat
9.0.0:milestone8
apachetomcat
9.0.0:milestone9
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
canonicalubuntu_linux
19.04
hpxp7_command_view
𝑥
< 8.6.5-00
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openjdk-11
bullseye
11.0.24+8-2~deb11u1
fixed
bullseye (security)
11.0.25+9-1~deb11u1
fixed
sid
11.0.25+9-1
fixed
openjdk-8
sid
8u432-b06-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
icedtea-web
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
not-affected
disco
not-affected
cosmic
not-affected
bionic
not-affected
xenial
not-affected
trusty
dne
openjdk-12
jammy
dne
impish
dne
hirsute
dne
groovy
dne
focal
dne
eoan
dne
disco
ignored
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
openjdk-6
jammy
dne
impish
dne
hirsute
dne
groovy
dne
focal
dne
eoan
dne
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
openjdk-7
jammy
dne
impish
dne
hirsute
dne
groovy
dne
focal
dne
eoan
dne
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
openjdk-8
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
not-affected
disco
Fixed 8u212-b03-0ubuntu1
released
cosmic
Fixed 8u212-b03-0ubuntu1.18.10.1
released
bionic
Fixed 8u212-b03-0ubuntu1.18.04.1
released
xenial
Fixed 8u212-b03-0ubuntu1.16.04.1
released
trusty
dne
openjdk-9
jammy
dne
impish
dne
hirsute
dne
groovy
dne
focal
dne
eoan
dne
disco
dne
cosmic
dne
bionic
dne
xenial
not-affected
trusty
dne
openjdk-lts
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
not-affected
disco
Fixed 11.0.3+7-1ubuntu2~19.04.1
released
cosmic
Fixed 11.0.3+7-1ubuntu2~18.10.1
released
bionic
Fixed 11.0.3+7-1ubuntu2~18.04.1
released
xenial
dne
trusty
dne
References