Input validation error - CVE-2018-2940

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33760

Input validation error - CVE-2018-2940

Published: July 18, 2018 / Updated: August 4, 2020


Vulnerability identifier: #VU33760
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-2940
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).


Affected software

Red Hat Satellite
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Opensuse
openjdk8 (Alpine package)
java-1.6.0-sun (Red Hat package)
java-1.6.0-sun-demo (Red Hat package)
java-1.6.0-sun-devel (Red Hat package)
java-1.6.0-sun-jdbc (Red Hat package)
java-1.6.0-sun-plugin (Red Hat package)
java-1.6.0-sun-src (Red Hat package)
java-1.7.1-ibm-plugin (Red Hat package)
java-1.7.1-ibm-src (Red Hat package)
java-1.7.1-ibm-jdbc (Red Hat package)
java-1.7.1-ibm-devel (Red Hat package)
java-1.7.1-ibm-demo (Red Hat package)
java-1.7.1-ibm (Red Hat package)
java-1.8.0-ibm-demo (Red Hat package)
java-1.8.0-ibm (Red Hat package)
java-1.8.0-ibm-devel (Red Hat package)
java-1.8.0-ibm-src (Red Hat package)
java-1.8.0-ibm-plugin (Red Hat package)
java-1.8.0-ibm-jdbc (Red Hat package)
IBM Tivoli Netcool Configuration Manager

How to mitigate CVE-2018-2940

Install update from vendor's website.

openjdk8 (Alpine package) - update to 8.181.13-r0
java-1.6.0-sun (Red Hat package) - addressed in versions 1.6.0.211-1jpp.1.el6, 1.6.0.211-1jpp.1.el7
java-1.6.0-sun-demo (Red Hat package) - addressed in versions 1.6.0.211-1jpp.1.el6, 1.6.0.211-1jpp.1.el7
java-1.6.0-sun-devel (Red Hat package) - addressed in versions 1.6.0.211-1jpp.1.el6, 1.6.0.211-1jpp.1.el7
java-1.6.0-sun-jdbc (Red Hat package) - addressed in versions 1.6.0.211-1jpp.1.el6, 1.6.0.211-1jpp.1.el7
java-1.6.0-sun-plugin (Red Hat package) - addressed in versions 1.6.0.211-1jpp.1.el6, 1.6.0.211-1jpp.1.el7
java-1.6.0-sun-src (Red Hat package) - addressed in versions 1.6.0.211-1jpp.1.el6, 1.6.0.211-1jpp.1.el7
java-1.7.1-ibm-plugin (Red Hat package) - addressed in versions 1.7.1.4.30-1jpp.1.el7, 1.7.1.4.30-1jpp.2.el6_10
java-1.7.1-ibm-src (Red Hat package) - addressed in versions 1.7.1.4.30-1jpp.1.el7, 1.7.1.4.30-1jpp.2.el6_10
java-1.7.1-ibm-jdbc (Red Hat package) - addressed in versions 1.7.1.4.30-1jpp.1.el7, 1.7.1.4.30-1jpp.2.el6_10
java-1.7.1-ibm-devel (Red Hat package) - addressed in versions 1.7.1.4.30-1jpp.1.el7, 1.7.1.4.30-1jpp.2.el6_10
java-1.7.1-ibm-demo (Red Hat package) - addressed in versions 1.7.1.4.30-1jpp.1.el7, 1.7.1.4.30-1jpp.2.el6_10
java-1.7.1-ibm (Red Hat package) - addressed in versions 1.7.1.4.30-1jpp.1.el7, 1.7.1.4.30-1jpp.2.el6_10
java-1.8.0-ibm-demo (Red Hat package) - addressed in versions 1.8.0.5.20-1jpp.1.el6_10, 1.8.0.5.20-1jpp.1.el7
java-1.8.0-ibm (Red Hat package) - addressed in versions 1.8.0.5.20-1jpp.1.el6_10, 1.8.0.5.20-1jpp.1.el7
java-1.8.0-ibm-devel (Red Hat package) - addressed in versions 1.8.0.5.20-1jpp.1.el6_10, 1.8.0.5.20-1jpp.1.el7
java-1.8.0-ibm-src (Red Hat package) - addressed in versions 1.8.0.5.20-1jpp.1.el6_10, 1.8.0.5.20-1jpp.1.el7
java-1.8.0-ibm-plugin (Red Hat package) - addressed in versions 1.8.0.5.20-1jpp.1.el6_10, 1.8.0.5.20-1jpp.1.el7
java-1.8.0-ibm-jdbc (Red Hat package) - addressed in versions 1.8.0.5.20-1jpp.1.el6_10, 1.8.0.5.20-1jpp.1.el7
IBM Tivoli Netcool Configuration Manager - addressed in versions 6.4.1.4.0.9, 6.4.2.7

External References

Related Security Bulletins