Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2024-20932

Vulnerability identifier: #VU85467

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20932

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Security component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Oracle GraalVM Enterprise Edition
Red Hat OpenShift Serverless
SecurID Governance and Lifecycle
IBM SPSS Collaboration and Deployment Services
Cryostat
Confluence Data Center
IBM Tivoli Netcool Impact
Security Event Manager (SEM)
IBM Sterling Connect:Direct FTP+
IBM Cloud Object Storage Systems
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Sterling Connect:Direct for UNIX
IBM Sterling Connect:Direct Web Services
IBM Sterling Control Center
EMC Data Protection Advisor
IBM Observability with Instana
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Legacy Module
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
RSA Identity Governance and Lifecycle
Confluence Server
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openjdk-17-jre-zero (Ubuntu package)
openjdk-17-jre-headless (Ubuntu package)
openjdk-17-jre (Ubuntu package)
openjdk-17-jdk-headless (Ubuntu package)
openjdk-17-jdk (Ubuntu package)
java-1_8_0-ibm
java-1_8_0-ibm-devel
java-1_8_0-ibm-alsa
java-1_8_0-ibm-plugin
java-1_8_0-ibm-32bit
java-1_8_0-ibm-devel-32bit
java-1_8_0-ibm-src
java-1_8_0-ibm-demo
java-17-openjdk (Red Hat package)
java-17-openjdk-src
java-17-openjdk-jmods
java-17-openjdk-javadoc-zip
java-17-openjdk-javadoc
java-17-openjdk-headless
java-17-openjdk-static-libs
java-17-openjdk-devel
java-17-openjdk-demo
java-17-openjdk
java-17-openjdk-devel-debuginfo
java-17-openjdk-debuginfo
java-17-openjdk-debugsource
java-17-openjdk-headless-debuginfo
openjdk-17 (debian package)
java-17-openjdk-jmods-slowdebug
java-17-openjdk-demo-slowdebug
java-17-openjdk-src-slowdebug
java-17-openjdk-devel-slowdebug
java-17-openjdk-headless-slowdebug
java-17-openjdk-slowdebug
java-latest-openjdk-src
java-latest-openjdk-slowdebug
java-latest-openjdk-jmods-slowdebug
java-latest-openjdk-jmods
java-latest-openjdk-javadoc-zip
java-latest-openjdk-javadoc
java-latest-openjdk-headless-slowdebug
java-latest-openjdk-headless
java-latest-openjdk-devel-slowdebug
java-latest-openjdk-devel
java-latest-openjdk-demo-slowdebug
java-latest-openjdk-demo
java-latest-openjdk
java-latest-openjdk-src-slowdebug
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
DB2 Query Management Facility
EMC ECS
Dell Policy Manager for Secure Connect Gateway (SCG)
IBM Semeru Runtimes
Total Storage Service Console (TSSC) / TS4500 IMC
OpenJDK Java (for Middleware)
Oracle GraalVM for JDK
Oracle Java SE
IBM App Connect Enterprise
IBM Sterling Connect:Direct File Agent
IBM Cognos Command Center

Install updates from vendor's website.

Red Hat OpenShift Serverless - update to 1.31.1
Confluence Server - addressed in versions 7.19.25, 8.5.12
Confluence Data Center - addressed in versions 7.19.25, 8.5.12, 8.9.4
IBM Tivoli Netcool Impact - update to 7.1.0.36
OpenJDK Java (for Middleware) - update to 17.0.10
Security Event Manager (SEM) - update to 2024.2
openjdk-17-jre-zero (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.10+7-1~20.04.1, 17.0.10+7-1~22.04.1, 17.0.10+7-1~23.10.1
openjdk-17-jre-headless (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.10+7-1~20.04.1, 17.0.10+7-1~22.04.1, 17.0.10+7-1~23.10.1
openjdk-17-jre (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.10+7-1~20.04.1, 17.0.10+7-1~22.04.1, 17.0.10+7-1~23.10.1
openjdk-17-jdk-headless (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.10+7-1~20.04.1, 17.0.10+7-1~22.04.1, 17.0.10+7-1~23.10.1
openjdk-17-jdk (Ubuntu package) - addressed in versions Ubuntu Pro, 17.0.10+7-1~20.04.1, 17.0.10+7-1~22.04.1, 17.0.10+7-1~23.10.1
IBM Sterling Connect:Direct FTP+ - update to 1.3.0.0.26
IBM Sterling Connect:Direct File Agent - update to 1.4.0.3.4
java-1_8_0-ibm - addressed in versions 1.8.0_sr8.20-30.120.1, 1.8.0_sr8.20-150000.3.86.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr8.20-30.120.1, 1.8.0_sr8.20-150000.3.86.1
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr8.20-30.120.1, 1.8.0_sr8.20-150000.3.86.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr8.20-30.120.1, 1.8.0_sr8.20-150000.3.86.1
java-1_8_0-ibm-32bit - update to 1.8.0_sr8.20-150000.3.86.1
java-1_8_0-ibm-devel-32bit - update to 1.8.0_sr8.20-150000.3.86.1
java-1_8_0-ibm-src - update to 1.8.0_sr8.20-150000.3.86.1
java-1_8_0-ibm-demo - update to 1.8.0_sr8.20-150000.3.86.1
EMC ECS - update to 3.8.1.1
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.50, 3.18.2.45
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.5
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.24.00.14
Dell Secure Connect Gateway - update to 5.26.00.18
IBM Sterling Connect:Direct for UNIX - addressed in versions 6.0.0.2.164, 6.1.0.4.106
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.24, 6.2.0.23, 6.3.0.7
IBM Sterling Control Center - addressed in versions 6.2.1.0.13, 6.3.1.0.2
IBM Semeru Runtimes - addressed in versions 8.0.402.0, 11.0.22.0, 17.0.10.0, 21.0.2.0
Total Storage Service Console (TSSC) / TS4500 IMC - update to 9.4.31
IBM Cognos Command Center - update to 10.2.5 IF2
IBM App Connect Enterprise - update to 12.0.11.3
java-17-openjdk (Red Hat package) - addressed in versions 17.0.10.0.7-1.el8_4, 17.0.10.0.7-1.el8_6
java-17-openjdk-src - update to 17.0.10.0.7-2.0.1
java-17-openjdk-jmods - update to 17.0.10.0.7-2.0.1
java-17-openjdk-javadoc-zip - update to 17.0.10.0.7-2.0.1
java-17-openjdk-javadoc - update to 17.0.10.0.7-2.0.1
java-17-openjdk-headless - update to 17.0.10.0.7-2.0.1
java-17-openjdk-static-libs - update to 17.0.10.0.7-2.0.1
java-17-openjdk-devel - update to 17.0.10.0.7-2.0.1
java-17-openjdk-demo - update to 17.0.10.0.7-2.0.1
java-17-openjdk - update to 17.0.10.0.7-2.0.1
java-17-openjdk-jmods - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-javadoc - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-devel-debuginfo - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-headless - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-debuginfo - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-src - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-debugsource - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-headless-debuginfo - update to 17.0.10.0-150400.3.36.1
java-17-openjdk - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-devel - update to 17.0.10.0-150400.3.36.1
java-17-openjdk-demo - update to 17.0.10.0-150400.3.36.1
openjdk-17 (debian package) - addressed in versions 17.0.10+7-1~deb11u1, 17.0.10+7-1~deb12u1
java-17-openjdk-debuginfo - update to 17.0.11.9-1
java-17-openjdk-jmods-slowdebug - update to 17.0.11.9-1
java-17-openjdk-javadoc - update to 17.0.11.9-1
java-17-openjdk-demo-slowdebug - update to 17.0.11.9-1
java-17-openjdk-src-slowdebug - update to 17.0.11.9-1
java-17-openjdk-src - update to 17.0.11.9-1
java-17-openjdk-headless - update to 17.0.11.9-1
java-17-openjdk-javadoc-zip - update to 17.0.11.9-1
java-17-openjdk-debugsource - update to 17.0.11.9-1
java-17-openjdk-devel-slowdebug - update to 17.0.11.9-1
java-17-openjdk-devel - update to 17.0.11.9-1
java-17-openjdk-jmods - update to 17.0.11.9-1
java-17-openjdk - update to 17.0.11.9-1
java-17-openjdk-demo - update to 17.0.11.9-1
java-17-openjdk-headless-slowdebug - update to 17.0.11.9-1
java-17-openjdk-slowdebug - update to 17.0.11.9-1
EMC Data Protection Advisor - update to 19.9 B120
java-latest-openjdk-src - update to 23.0.1.11-1
java-latest-openjdk-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-jmods-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-jmods - update to 23.0.1.11-1
java-latest-openjdk-javadoc-zip - update to 23.0.1.11-1
java-latest-openjdk-javadoc - update to 23.0.1.11-1
java-latest-openjdk-headless-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-headless - update to 23.0.1.11-1
java-latest-openjdk-devel-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-devel - update to 23.0.1.11-1
java-latest-openjdk-demo-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-demo - update to 23.0.1.11-1
java-latest-openjdk - update to 23.0.1.11-1
java-latest-openjdk-src-slowdebug - update to 23.0.1.11-1
IBM Observability with Instana - update to 267

• https://www.oracle.com/security-alerts/cpujan2024.html

• Multiple vulnerabilities in Oracle Java SE
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in Oracle GraalVM for JDK
• Red Hat Enterprise Linux 8 update for java-17-openjdk
• Red Hat Enterprise Linux 8.6 Extended Update Support update for java-17-openjdk
• Multiple vulnerabilities in Red Hat OpenJDK 17
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• SUSE update for java-17-openjdk
• Multiple vulnerabilities in IBM Semeru Runtime
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• SUSE update for java-1_8_0-ibm
• SUSE update for java-1_8_0-ibm
• Ubuntu update for openjdk-17
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in IBM CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM Sterling Connect:Direct File Agent
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Cloud Object System
• Multiple vulnerabilities in IBM Decision Optimization for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Sterling Connect:Direct FTP+
• Multiple vulnerabilities in IBM Sterling Connect:Direct for UNIX
• SolarWinds Security Event Manager (SEM) update for third-party components
• Multiple vulnerabilities in IBM Cognos Command Center
• Improper input validation in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• openEuler 20.03 LTS SP4 update for openjdk-17
• openEuler 22.03 LTS SP1 update for openjdk-17
• openEuler 22.03 LTS SP2 update for openjdk-17
• openEuler 22.03 LTS SP3 update for openjdk-17
• Multiple vulnerabilities in Dell Data Protection Advisor and PowerProtect DP Series Appliance (IDPA)
• Multiple vulnerabilities in Dell Secure Connect Gateway Policy Manager
• Debian update for openjdk-17
• Multiple vulnerabilities in Dell ECS
• Confluence Data Center and Server update for third-party software
• Amazon Linux AMI update for java-17-amazon-corretto
• Multiple vulnerabilities in IBM Sterling Control Center
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Total Storage Service Console (TSSC) / TS4500 IMC
• openEuler 22.03 LTS SP4 update for openjdk-latest
• openEuler 24.03 LTS update for openjdk-latest
• openEuler 22.03 LTS SP1 update for openjdk-latest
• openEuler 20.03 LTS SP4 update for openjdk-latest
• openEuler 22.03 LTS SP3 update for openjdk-latest
• Gentoo update for OpenJDK
• Multiple vulnerabilities in IBM Db2 Query Management Facility
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Anolis OS update for java-17-openjdk
• RSA Governance and Lifecycle update for Oracle Databse