Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2024-20932

Vulnerability identifier: #VU85467

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-20932

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Oracle GraalVM Enterprise Edition
Red Hat OpenShift Serverless
SecurID Governance and Lifecycle
IBM SPSS Collaboration and Deployment Services
Cryostat
Confluence Data Center
IBM Tivoli Netcool Impact
Security Event Manager (SEM)
IBM Sterling Connect:Direct FTP+
IBM Cloud Object Storage Systems
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Sterling Connect:Direct for UNIX
IBM Sterling Connect:Direct Web Services
IBM Sterling Control Center
EMC Data Protection Advisor
IBM Observability with Instana
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Legacy Module
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
RSA Identity Governance and Lifecycle
Confluence Server
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openjdk-17-jre-zero (Ubuntu package)
openjdk-17-jre-headless (Ubuntu package)
openjdk-17-jre (Ubuntu package)
openjdk-17-jdk-headless (Ubuntu package)
openjdk-17-jdk (Ubuntu package)
java-1_8_0-ibm
java-1_8_0-ibm-devel
java-1_8_0-ibm-alsa
java-1_8_0-ibm-plugin
java-1_8_0-ibm-32bit
java-1_8_0-ibm-devel-32bit
java-1_8_0-ibm-src
java-1_8_0-ibm-demo
java-17-openjdk (Red Hat package)
java-17-openjdk-src
java-17-openjdk-jmods
java-17-openjdk-javadoc-zip
java-17-openjdk-javadoc
java-17-openjdk-headless
java-17-openjdk-static-libs
java-17-openjdk-devel
java-17-openjdk-demo
java-17-openjdk
java-17-openjdk-devel-debuginfo
java-17-openjdk-debuginfo
java-17-openjdk-debugsource
java-17-openjdk-headless-debuginfo
openjdk-17 (debian package)
java-17-openjdk-jmods-slowdebug
java-17-openjdk-demo-slowdebug
java-17-openjdk-src-slowdebug
java-17-openjdk-devel-slowdebug
java-17-openjdk-headless-slowdebug
java-17-openjdk-slowdebug
java-latest-openjdk-src
java-latest-openjdk-slowdebug
java-latest-openjdk-jmods-slowdebug
java-latest-openjdk-jmods
java-latest-openjdk-javadoc-zip
java-latest-openjdk-javadoc
java-latest-openjdk-headless-slowdebug
java-latest-openjdk-headless
java-latest-openjdk-devel-slowdebug
java-latest-openjdk-devel
java-latest-openjdk-demo-slowdebug
java-latest-openjdk-demo
java-latest-openjdk
java-latest-openjdk-src-slowdebug
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
DB2 Query Management Facility
EMC ECS
Dell Policy Manager for Secure Connect Gateway (SCG)
IBM Semeru Runtimes
Total Storage Service Console (TSSC) / TS4500 IMC
OpenJDK Java (for Middleware)
Oracle GraalVM for JDK
Oracle Java SE
IBM App Connect Enterprise
IBM Sterling Connect:Direct File Agent
IBM Cognos Command Center

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Security component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install updates from vendor's website.

• https://www.oracle.com/security-alerts/cpujan2024.html