Improper input validation in Java SE Embedded - CVE-2019-2894

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28699

Improper input validation in Java SE Embedded - CVE-2019-2894

Published: June 5, 2020


Vulnerability identifier: #VU28699
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-2894
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


Affected software

Java SE Embedded
Oracle Java SE
Data Computing Appliance (DCA)
EMC ECS
IBM Tivoli Application Dependency Discovery Manager
openjdk8 (Alpine package)
Opensuse
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Data Protection Search
EMC Data Protection Advisor

How to mitigate CVE-2019-2894

Install updates from vendor's website.

Data Computing Appliance (DCA) - update to 3.5.5.0
IBM Tivoli Application Dependency Discovery Manager - update to 7.3.0.6
openjdk8 (Alpine package) - update to 8.232.09-r0
EMC ECS - update to 3.5.0.1
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Data Protection Search - update to 19.2
EMC Data Protection Advisor - update to 19.3

External References

Related Security Bulletins