Information disclosure in Oracle Java SE and Java SE Embedded - CVE-2019-2422

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17051

Information disclosure in Oracle Java SE and Java SE Embedded - CVE-2019-2422

Published: January 17, 2019 / Updated: April 9, 2019


Vulnerability identifier: #VU17051
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-2422
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to unspecified flaw in Libraries component. A remote attacker can gain access to sensitive information on the system.

Affected software

Oracle Java SE
Java SE Embedded
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power
Opensuse
IBM Cloud Transformation Advisor
Red Hat Satellite
EMC Data Protection Advisor
Dell EMC Data Protection Search
openjdk-7 (Ubuntu package)
openjdk8 (Alpine package)
openjdk-8 (Debian package)
openjdk-lts (Ubuntu package)
java-1.7.1-ibm-src (Red Hat package)
java-1.7.1-ibm-plugin (Red Hat package)
java-1.7.1-ibm-jdbc (Red Hat package)
java-1.7.1-ibm-devel (Red Hat package)
java-1.7.1-ibm-demo (Red Hat package)
java-1.7.1-ibm (Red Hat package)
java-1.8.0-ibm-plugin (Red Hat package)
java-1.8.0-ibm-jdbc (Red Hat package)
java-1.8.0-ibm-devel (Red Hat package)
java-1.8.0-ibm-demo (Red Hat package)
java-1.8.0-ibm (Red Hat package)
java-1.8.0-ibm-src (Red Hat package)
EMC Integrated Data Protection Appliance
Data Computing Appliance (DCA)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

How to mitigate CVE-2019-2422

Install update from vendor's website.

IBM Cloud Transformation Advisor - update to 1.9.8
openjdk-7 (Ubuntu package) - update to 7u211-2.6.17-0ubuntu0.1
openjdk8 (Alpine package) - addressed in versions 8.191.12-r0, 8.201.08-r0
openjdk-8 (Debian package) - update to 8u212-b01-1~deb9u1
openjdk-lts (Ubuntu package) - update to 11.0.2+9-3ubuntu1~18.04.3
java-1.7.1-ibm-src (Red Hat package) - addressed in versions 1.7.1.4.40-1jpp.1.el6_10, 1.7.1.4.40-1jpp.1.el7
java-1.7.1-ibm-plugin (Red Hat package) - addressed in versions 1.7.1.4.40-1jpp.1.el6_10, 1.7.1.4.40-1jpp.1.el7
java-1.7.1-ibm-jdbc (Red Hat package) - addressed in versions 1.7.1.4.40-1jpp.1.el6_10, 1.7.1.4.40-1jpp.1.el7
java-1.7.1-ibm-devel (Red Hat package) - addressed in versions 1.7.1.4.40-1jpp.1.el6_10, 1.7.1.4.40-1jpp.1.el7
java-1.7.1-ibm-demo (Red Hat package) - addressed in versions 1.7.1.4.40-1jpp.1.el6_10, 1.7.1.4.40-1jpp.1.el7
java-1.7.1-ibm (Red Hat package) - addressed in versions 1.7.1.4.40-1jpp.1.el6_10, 1.7.1.4.40-1jpp.1.el7
java-1.8.0-ibm-plugin (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-jdbc (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-devel (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-demo (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-src (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
EMC Integrated Data Protection Appliance - update to 2.3
Data Computing Appliance (DCA) - update to 3.5.3.0
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
EMC Data Protection Advisor - addressed in versions 6.5 patch 136, 18.1 patch 74, 18.2 patch 26
Dell EMC Data Protection Search - update to 18.2.1

External References

Related Security Bulletins