CVE-2023-2597

2023-05-2212:15:09

CWE-120

CWE-125

[email protected]

web.nvd.nist.gov

eclipse

openj9

cve-2023-2597

nvd

security vulnerability

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.3%

JSON

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer.

Affected configurations

NVD

Node

eclipseopenj9Range<0.38.0

CPENameOperatorVersion
eclipse:openj9eclipse openj9lt0.38.0

CPE	Name	Operator	Version
eclipse:openj9	eclipse openj9	lt	0.38.0

CNA Affected

[
  {
    "vendor": "Eclipse Foundation",
    "product": "Eclipse OpenJ9",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "0.37.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]