CVE-2019-2989

NameCVE-2019-2989
DescriptionVulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java). The supported version that is affected is 19.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle GraalVM Enterprise Edition accessible data. CVSS 3.0 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4546-1, DSA-4548-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openjdk-11 (PTS)buster11.0.4+11-1~deb10u1vulnerable
buster (security)11.0.5+10-1~deb10u1fixed
bullseye, sid11.0.5+10-2fixed
openjdk-7 (PTS)jessie7u181-2.6.14-1~deb8u1vulnerable
jessie (security)7u231-2.6.19-1~deb8u2vulnerable
openjdk-8 (PTS)stretch8u222-b10-1~deb9u1vulnerable
stretch (security)8u232-b09-1~deb9u1fixed
sid8u232-b09-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openjdk-11source(unstable)11.0.5+10-1
openjdk-11sourcebuster11.0.5+10-1~deb10u1DSA-4546-1
openjdk-7source(unstable)(unfixed)
openjdk-8source(unstable)8u232-b09-1
openjdk-8sourcestretch8u232-b09-1~deb9u1DSA-4548-1

Search for package or bug name: Reporting problems