Improper access control in Oracle Java SE - CVE-2019-2697

Vulnerability identifier: #VU77358

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-2697

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Oracle Java SE
IBM Cloud Transformation Advisor
Red Hat Satellite
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
java-1.7.1-ibm-src (Red Hat package)
java-1.7.1-ibm-plugin (Red Hat package)
java-1.7.1-ibm-jdbc (Red Hat package)
java-1.7.1-ibm-devel (Red Hat package)
java-1.7.1-ibm-demo (Red Hat package)
java-1.7.1-ibm (Red Hat package)
java-1.8.0-ibm-devel (Red Hat package)
java-1.8.0-ibm (Red Hat package)
java-1.8.0-ibm-src (Red Hat package)
java-1.8.0-ibm-plugin (Red Hat package)
java-1.8.0-ibm-jdbc (Red Hat package)
java-1.8.0-ibm-demo (Red Hat package)

Install updates from vendor's website.

IBM Cloud Transformation Advisor - update to 1.9.8
java-1.7.1-ibm-src (Red Hat package) - addressed in versions 1.7.1.4.45-1jpp.1.el6_10, 1.7.1.4.45-1jpp.1.el7
java-1.7.1-ibm-plugin (Red Hat package) - addressed in versions 1.7.1.4.45-1jpp.1.el6_10, 1.7.1.4.45-1jpp.1.el7
java-1.7.1-ibm-jdbc (Red Hat package) - addressed in versions 1.7.1.4.45-1jpp.1.el6_10, 1.7.1.4.45-1jpp.1.el7
java-1.7.1-ibm-devel (Red Hat package) - addressed in versions 1.7.1.4.45-1jpp.1.el6_10, 1.7.1.4.45-1jpp.1.el7
java-1.7.1-ibm-demo (Red Hat package) - addressed in versions 1.7.1.4.45-1jpp.1.el6_10, 1.7.1.4.45-1jpp.1.el7
java-1.7.1-ibm (Red Hat package) - addressed in versions 1.7.1.4.45-1jpp.1.el6_10, 1.7.1.4.45-1jpp.1.el7
java-1.8.0-ibm-devel (Red Hat package) - addressed in versions 1.8.0.5.35-1jpp.1.el6_10, 1.8.0.5.35-1jpp.1.el7
java-1.8.0-ibm (Red Hat package) - addressed in versions 1.8.0.5.35-1jpp.1.el6_10, 1.8.0.5.35-1jpp.1.el7
java-1.8.0-ibm-src (Red Hat package) - addressed in versions 1.8.0.5.35-1jpp.1.el6_10, 1.8.0.5.35-1jpp.1.el7
java-1.8.0-ibm-plugin (Red Hat package) - addressed in versions 1.8.0.5.35-1jpp.1.el6_10, 1.8.0.5.35-1jpp.1.el7
java-1.8.0-ibm-jdbc (Red Hat package) - addressed in versions 1.8.0.5.35-1jpp.1.el6_10, 1.8.0.5.35-1jpp.1.el7
java-1.8.0-ibm-demo (Red Hat package) - addressed in versions 1.8.0.5.35-1jpp.1.el6_10, 1.8.0.5.35-1jpp.1.el7

• http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://usn.ubuntu.com/3975-1/
• https://access.redhat.com/errata/RHSA-2019:1166
• https://access.redhat.com/errata/RHSA-2019:1165
• https://access.redhat.com/errata/RHSA-2019:1164
• https://access.redhat.com/errata/RHSA-2019:1163
• https://access.redhat.com/errata/RHSA-2019:1238
• https://access.redhat.com/errata/RHSA-2019:1325
• https://security.gentoo.org/glsa/201908-10
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us

• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Red Hat Enterprise Linux 7 Supplementary update for java-1.7.1-ibm
• Red Hat Enterprise Linux 6 Supplementary update for java-1.7.1-ibm
• Red Hat Enterprise Linux 7 Supplementary update for java-1.8.0-ibm
• Red Hat Enterprise Linux 6 Supplementary update for java-1.8.0-ibm
• Red Hat Satellite 5 update for java-1.8.0-ibm