Oracle Java SE and GraalVM Vulnerability Allowing Unauthorized Data Access

A vulnerability has been identified in multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This vulnerability, which affects the Hotspot component, allows an unauthenticated attacker with network access to compromise the Java runtime. Successful exploitation can lead to unauthorized read access and the ability to update, insert, or delete certain accessible data. The vulnerability can be exploited through APIs, potentially via a web service, and also impacts Java deployments that run untrusted code from the internet, relying on the Java sandbox for security.

Impact

Exploitation of this vulnerability can result in unauthorized access to read, modify, or delete certain data within the affected Java runtime environments.

Remediation

Users can upgrade to the latest versions of OpenJDK 11 or OpenJDK 17. For Oracle products, refer to the Oracle January 2025 Critical Patch Update. NetApp products affected by this vulnerability can be updated according to the guidance provided in the NetApp advisory NTAP-20250124-0009.