Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2025-21502

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU103159

Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2025-21502

Published: January 21, 2025 / Updated: January 29, 2025


Vulnerability identifier: #VU103159
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-21502
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


Affected software

Oracle GraalVM Enterprise Edition
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
Debian Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Anolis OS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Basesystem Module
Legacy Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
SecurID Governance and Lifecycle
Netcool Operations Insight
Splunk User Behavior Analytics (UBA)
IBM Maximo Application Suite
App Connect Enterprise Certified Container
Red Hat Integration Camel-K
IBM Cloud Pak for Security
Ansible Automation Platform
APEX Cloud Platform for Red Hat OpenShift
PowerProtect Data Manager
Red Hat build of Keycloak
RSA Identity Governance and Lifecycle
Netezza Appliance
Rapid Infrastructure Automation
Cloud Pak for Network Automation
Maximo Application Suite - IoT Component
APEX Cloud Platform for Microsoft Azure
Storage Resource Manager
Oracle Java SE
OpenJDK Java (for Middleware)
Oracle GraalVM for JDK
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
java-11-openjdk (Red Hat package)
java-21-openjdk (Red Hat package)
openjdk-17-jre-zero (Ubuntu package)
openjdk-17-jre-headless (Ubuntu package)
openjdk-11-jdk (Ubuntu package)
openjdk-17-jre (Ubuntu package)
openjdk-11-jdk-headless (Ubuntu package)
openjdk-11-jre-zero (Ubuntu package)
openjdk-11-jre-headless (Ubuntu package)
openjdk-17-jdk (Ubuntu package)
openjdk-11-jre (Ubuntu package)
openjdk-17-jdk-headless (Ubuntu package)
java-1_8_0-ibm
java-1_8_0-ibm-alsa
java-1_8_0-ibm-devel
java-1_8_0-ibm-plugin
java-1_8_0-ibm-demo
java-1_8_0-ibm-src
java-1_8_0-ibm-32bit
java-1_8_0-ibm-devel-32bit
java-1.8.0-ibm-src (Red Hat package)
java-1.8.0-ibm-plugin (Red Hat package)
java-1.8.0-ibm (Red Hat package)
java-1.8.0-ibm-jdbc (Red Hat package)
java-1.8.0-ibm-headless (Red Hat package)
java-1.8.0-ibm-webstart (Red Hat package)
java-1.8.0-ibm-devel (Red Hat package)
java-1.8.0-ibm-demo (Red Hat package)
java-11-openjdk-devel
java-11-openjdk-debugsource
java-11-openjdk-debuginfo
java-11-openjdk-headless
java-11-openjdk
java-11-openjdk-demo
java-11-openjdk-devel-debuginfo
java-11-openjdk-headless-debuginfo
java-11-openjdk-javadoc
java-11-openjdk-src
java-11-openjdk-jmods
java-17-openjdk (Red Hat package)
java-17-openjdk-devel
java-17-openjdk-headless
java-17-openjdk-javadoc
java-17-openjdk-javadoc-zip
java-17-openjdk-jmods
java-17-openjdk-demo
java-17-openjdk-src
java-17-openjdk-static-libs
java-17-openjdk
java-17-openjdk-debuginfo
java-17-openjdk-headless-debuginfo
java-17-openjdk-debugsource
java-17-openjdk-devel-debuginfo
openjdk-17-crac-jre-headless (Ubuntu package)
openjdk-17-crac-jre-zero (Ubuntu package)
openjdk-17-crac-jre (Ubuntu package)
openjdk-17-crac-jdk-headless (Ubuntu package)
openjdk-17-crac-jdk (Ubuntu package)
openjdk-17 (debian package)
java-21-openjdk-static-libs
java-21-openjdk-src
java-21-openjdk-jmods
java-21-openjdk-javadoc-zip
java-21-openjdk-javadoc
java-21-openjdk-headless
java-21-openjdk-devel
java-21-openjdk-demo
java-21-openjdk
java-21-openjdk-debuginfo
java-21-openjdk-debugsource
java-21-openjdk-headless-debuginfo
java-21-openjdk-devel-debuginfo
openjdk-21-crac-jdk (Ubuntu package)
openjdk-21-crac-jdk-headless (Ubuntu package)
openjdk-21-crac-jre (Ubuntu package)
openjdk-21-crac-jre-headless (Ubuntu package)
openjdk-21-crac-jre-zero (Ubuntu package)
openjdk-21-jre-headless (Ubuntu package)
openjdk-21-jdk (Ubuntu package)
openjdk-21-jre (Ubuntu package)
openjdk-21-jre-zero (Ubuntu package)
openjdk-21-jdk-headless (Ubuntu package)
openjdk-23-jdk (Ubuntu package)
openjdk-23-jdk-headless (Ubuntu package)
openjdk-23-jre (Ubuntu package)
openjdk-23-jre-headless (Ubuntu package)
openjdk-23-jre-zero (Ubuntu package)
RSA Authentication Manager
IBM Cloud Pak for Multicloud Management
Integrated Data protection Appliance (IDPA)
Data Protection Search
Dell EMC Storage Monitoring and Reporting (SMR)

How to mitigate CVE-2025-21502

Install updates from vendor's website.

Netezza Appliance - update to 1.0.0.1
Rapid Infrastructure Automation - update to 1.1.5.3
Netcool Operations Insight - update to 1.6.15
Cloud Pak for Network Automation - update to 2.7.8
Splunk User Behavior Analytics (UBA) - update to 5.4.3
Maximo Application Suite - IoT Component - addressed in versions 8.7.29, 8.8.26, 9.0.15, 9.1.6
RSA Authentication Manager - update to 8.7 SP2 Patch 6
IBM Maximo Application Suite - addressed in versions 8.10.32, 8.11.29, 9.0.18, 9.1.7
OpenJDK Java (for Middleware) - addressed in versions 11.0.26, 17.0.14, 21.0.6
java-11-openjdk (Red Hat package) - addressed in versions 11.0.26.0.4-1.el7_9, 11.0.26.0.4-1.el8, 11.0.26.0.4-1.el9
App Connect Enterprise Certified Container - update to 12.9.0
java-21-openjdk (Red Hat package) - addressed in versions 21.0.6.0.7-1.el8, 21.0.6.0.7-1.el9
openjdk-17-jre-zero (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.14+7-1~20.04, 17.0.14+7-1~22.04.1, 17.0.14+7-1~24.04, 17.0.14+7-1~24.10
openjdk-17-jre-headless (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.14+7-1~20.04, 17.0.14+7-1~22.04.1, 17.0.14+7-1~24.04, 17.0.14+7-1~24.10
openjdk-11-jdk (Ubuntu package) - addressed in versions Ubuntu Pro, 11.0.26+4-1ubuntu1~20.04, 11.0.26+4-1ubuntu1~22.04, 11.0.26+4-1ubuntu1~24.04, 11.0.26+4-1ubuntu1~24.10
openjdk-17-jre (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.14+7-1~20.04, 17.0.14+7-1~22.04.1, 17.0.14+7-1~24.04, 17.0.14+7-1~24.10
openjdk-11-jdk-headless (Ubuntu package) - addressed in versions Ubuntu Pro, 11.0.26+4-1ubuntu1~20.04, 11.0.26+4-1ubuntu1~22.04, 11.0.26+4-1ubuntu1~24.04, 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre-zero (Ubuntu package) - addressed in versions Ubuntu Pro, 11.0.26+4-1ubuntu1~20.04, 11.0.26+4-1ubuntu1~22.04, 11.0.26+4-1ubuntu1~24.04, 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre-headless (Ubuntu package) - addressed in versions Ubuntu Pro, 11.0.26+4-1ubuntu1~20.04, 11.0.26+4-1ubuntu1~22.04, 11.0.26+4-1ubuntu1~24.04, 11.0.26+4-1ubuntu1~24.10
openjdk-17-jdk (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.14+7-1~20.04, 17.0.14+7-1~22.04.1, 17.0.14+7-1~24.04, 17.0.14+7-1~24.10
openjdk-11-jre (Ubuntu package) - addressed in versions Ubuntu Pro, 11.0.26+4-1ubuntu1~20.04, 11.0.26+4-1ubuntu1~22.04, 11.0.26+4-1ubuntu1~24.04, 11.0.26+4-1ubuntu1~24.10
openjdk-17-jdk-headless (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.14+7-1~20.04, 17.0.14+7-1~22.04.1, 17.0.14+7-1~24.04, 17.0.14+7-1~24.10
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
java-1_8_0-ibm - addressed in versions 1.8.0_sr8.40-30.132.1, 1.8.0_sr8.40-150000.3.98.1
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr8.40-30.132.1, 1.8.0_sr8.40-150000.3.98.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr8.40-30.132.1, 1.8.0_sr8.40-150000.3.98.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr8.40-30.132.1, 1.8.0_sr8.40-150000.3.98.1
java-1_8_0-ibm-demo - update to 1.8.0_sr8.40-150000.3.98.1
java-1_8_0-ibm-src - update to 1.8.0_sr8.40-150000.3.98.1
java-1_8_0-ibm-32bit - update to 1.8.0_sr8.40-150000.3.98.1
java-1_8_0-ibm-devel-32bit - update to 1.8.0_sr8.40-150000.3.98.1
java-1.8.0-ibm-src (Red Hat package) - update to 1.8.0.8.40-1.el8_10
java-1.8.0-ibm-plugin (Red Hat package) - update to 1.8.0.8.40-1.el8_10
java-1.8.0-ibm (Red Hat package) - update to 1.8.0.8.40-1.el8_10
java-1.8.0-ibm-jdbc (Red Hat package) - update to 1.8.0.8.40-1.el8_10
java-1.8.0-ibm-headless (Red Hat package) - update to 1.8.0.8.40-1.el8_10
java-1.8.0-ibm-webstart (Red Hat package) - update to 1.8.0.8.40-1.el8_10
java-1.8.0-ibm-devel (Red Hat package) - update to 1.8.0.8.40-1.el8_10
java-1.8.0-ibm-demo (Red Hat package) - update to 1.8.0.8.40-1.el8_10
Red Hat Integration Camel-K - update to 1.10.9
IBM Cloud Pak for Security - update to 1.11.2.0
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
Ansible Automation Platform - addressed in versions 2.4, 2.5
Integrated Data protection Appliance (IDPA) - update to 2.7.8 with DP Search 19.6.6
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
Storage Resource Manager - addressed in versions 5.0.2.2, 5.1.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - addressed in versions 5.0.2.2, 5.1.0.0
java-11-openjdk-devel - addressed in versions 11.0.26.0-3.84.1, 11.0.26.0-150000.3.122.1
java-11-openjdk-debugsource - addressed in versions 11.0.26.0-3.84.1, 11.0.26.0-150000.3.122.1
java-11-openjdk-debuginfo - addressed in versions 11.0.26.0-3.84.1, 11.0.26.0-150000.3.122.1
java-11-openjdk-headless - addressed in versions 11.0.26.0-3.84.1, 11.0.26.0-150000.3.122.1
java-11-openjdk - addressed in versions 11.0.26.0-3.84.1, 11.0.26.0-150000.3.122.1
java-11-openjdk-demo - addressed in versions 11.0.26.0-3.84.1, 11.0.26.0-150000.3.122.1
java-11-openjdk-devel-debuginfo - update to 11.0.26.0-150000.3.122.1
java-11-openjdk-headless-debuginfo - update to 11.0.26.0-150000.3.122.1
java-11-openjdk-javadoc - update to 11.0.26.0-150000.3.122.1
java-11-openjdk-src - update to 11.0.26.0-150000.3.122.1
java-11-openjdk-jmods - update to 11.0.26.0-150000.3.122.1
java-17-openjdk (Red Hat package) - addressed in versions 17.0.14.0.7-1.el8_4, 17.0.14.0.7-1.el8_6, 17.0.14.0.7-1.el9_0, 17.0.14.0.7-2.el9, 17.0.14.0.7-3.el8
java-17-openjdk-devel - update to 17.0.14.0.7-3.0.2
java-17-openjdk-headless - update to 17.0.14.0.7-3.0.2
java-17-openjdk-javadoc - update to 17.0.14.0.7-3.0.2
java-17-openjdk-javadoc-zip - update to 17.0.14.0.7-3.0.2
java-17-openjdk-jmods - update to 17.0.14.0.7-3.0.2
java-17-openjdk-demo - update to 17.0.14.0.7-3.0.2
java-17-openjdk-src - update to 17.0.14.0.7-3.0.2
java-17-openjdk-static-libs - update to 17.0.14.0.7-3.0.2
java-17-openjdk - update to 17.0.14.0.7-3.0.2
java-17-openjdk-debuginfo - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-headless-debuginfo - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-debugsource - update to 17.0.14.0-150400.3.51.1
java-17-openjdk - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-demo - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-src - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-headless - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-devel-debuginfo - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-javadoc - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-jmods - update to 17.0.14.0-150400.3.51.1
java-17-openjdk-devel - update to 17.0.14.0-150400.3.51.1
openjdk-17-crac-jre-headless (Ubuntu package) - update to 17.0.14+7-0ubuntu1~24.10
openjdk-17-crac-jre-zero (Ubuntu package) - update to 17.0.14+7-0ubuntu1~24.10
openjdk-17-crac-jre (Ubuntu package) - update to 17.0.14+7-0ubuntu1~24.10
openjdk-17-crac-jdk-headless (Ubuntu package) - update to 17.0.14+7-0ubuntu1~24.10
openjdk-17-crac-jdk (Ubuntu package) - update to 17.0.14+7-0ubuntu1~24.10
openjdk-17 (debian package) - update to 17.0.14+7-1~deb12u1
Data Protection Search - update to 19.6.6
PowerProtect Data Manager - update to 19.19.0-15
java-21-openjdk-static-libs - update to 21.0.6.0.7-1.0.2
java-21-openjdk-src - update to 21.0.6.0.7-1.0.2
java-21-openjdk-jmods - update to 21.0.6.0.7-1.0.2
java-21-openjdk-javadoc-zip - update to 21.0.6.0.7-1.0.2
java-21-openjdk-javadoc - update to 21.0.6.0.7-1.0.2
java-21-openjdk-headless - update to 21.0.6.0.7-1.0.2
java-21-openjdk-devel - update to 21.0.6.0.7-1.0.2
java-21-openjdk-demo - update to 21.0.6.0.7-1.0.2
java-21-openjdk - update to 21.0.6.0.7-1.0.2
java-21-openjdk - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-debuginfo - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-devel - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-debugsource - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-jmods - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-headless-debuginfo - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-headless - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-demo - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-devel-debuginfo - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-src - update to 21.0.6.0-150600.3.9.1
java-21-openjdk-javadoc - update to 21.0.6.0-150600.3.9.1
openjdk-21-crac-jdk (Ubuntu package) - update to 21.0.6+7-0ubuntu1~24.10
openjdk-21-crac-jdk-headless (Ubuntu package) - update to 21.0.6+7-0ubuntu1~24.10
openjdk-21-crac-jre (Ubuntu package) - update to 21.0.6+7-0ubuntu1~24.10
openjdk-21-crac-jre-headless (Ubuntu package) - update to 21.0.6+7-0ubuntu1~24.10
openjdk-21-crac-jre-zero (Ubuntu package) - update to 21.0.6+7-0ubuntu1~24.10
openjdk-21-jre-headless (Ubuntu package) - addressed in versions 21.0.6+7-1~20.04.1, 21.0.6+7-1~22.04.1, 21.0.6+7-1~24.04.1, 21.0.6+7-1~24.10.1
openjdk-21-jdk (Ubuntu package) - addressed in versions 21.0.6+7-1~20.04.1, 21.0.6+7-1~22.04.1, 21.0.6+7-1~24.04.1, 21.0.6+7-1~24.10.1
openjdk-21-jre (Ubuntu package) - addressed in versions 21.0.6+7-1~20.04.1, 21.0.6+7-1~22.04.1, 21.0.6+7-1~24.04.1, 21.0.6+7-1~24.10.1
openjdk-21-jre-zero (Ubuntu package) - addressed in versions 21.0.6+7-1~20.04.1, 21.0.6+7-1~22.04.1, 21.0.6+7-1~24.04.1, 21.0.6+7-1~24.10.1
openjdk-21-jdk-headless (Ubuntu package) - addressed in versions 21.0.6+7-1~20.04.1, 21.0.6+7-1~22.04.1, 21.0.6+7-1~24.04.1, 21.0.6+7-1~24.10.1
openjdk-23-jdk (Ubuntu package) - update to 23.0.2+7-1ubuntu1~24.10
openjdk-23-jdk-headless (Ubuntu package) - update to 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre (Ubuntu package) - update to 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre-headless (Ubuntu package) - update to 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre-zero (Ubuntu package) - update to 23.0.2+7-1ubuntu1~24.10
Red Hat build of Keycloak - update to 26.0.10

External References

Related Security Bulletins