CVE-2019-2684

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

5.9

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 1.82% Top 20%

Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory debian.org Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory oracle.com

Affected: Oracle Corporation Java

References

Link	Tags
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	patch vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html	third party advisory vendor advisory
https://access.redhat.com/errata/RHBA-2019:0959	mailing list third party advisory vendor advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html	third party advisory mailing list
https://access.redhat.com/errata/RHSA-2019:1146	third party advisory vendor advisory
https://usn.ubuntu.com/3975-1/	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:1164	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:1163	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:1165	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:1166	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:1238	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html	mailing list third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html	mailing list third party advisory vendor advisory
https://www.debian.org/security/2019/dsa-4453	third party advisory vendor advisory
https://seclists.org/bugtraq/2019/May/75	third party advisory mailing list
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html	mailing list third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:1325	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:1518	third party advisory vendor advisory
https://security.gentoo.org/glsa/201908-10	third party advisory vendor advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	third party advisory
https://lists.apache.org/thread.html/f7f54b4888060d99f59993f006e25005a2b58db0c07ff866bdcd6f17%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/c58d6c3b49c615916b163809f963a55421cac2264885739508e68108%40%3Cannounce.apache.org%3E	mailing list
https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/38a01302c92ae513910d8c851a2d111736565bd698be4e3af3e4c063%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/71bd3e4e222479c266eaafc8d0c171ef5782a69b52f68df11b650ed7%40%3Cusers.tomcat.apache.org%3E	mailing list
https://support.f5.com/csp/article/K11175903?utm_source=f5support&%3Butm_medium=RSS
https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cdev.cassandra.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cuser.cassandra.apache.org%3E	mailing list
http://www.openwall.com/lists/oss-security/2020/09/01/4	third party advisory mailing list
https://lists.apache.org/thread.html/r718e01f61b35409a4f7a3ccbc1cb5136a1558a9f9c2cb8d4ca9be1ce%40%3Cuser.cassandra.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r1fd117082b992e7d43c1286e966c285f98aa362e685695d999ff42f7%40%3Cuser.cassandra.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc%40%3Cuser.cassandra.apache.org%3E	mailing list

Frequently Asked Questions

What is the severity of CVE-2019-2684?: CVE-2019-2684 has been scored as a medium severity vulnerability.
How to fix CVE-2019-2684?: To fix CVE-2019-2684, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-2684 being actively exploited in the wild?: It is possible that CVE-2019-2684 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-2684?: CVE-2019-2684 affects Oracle Corporation Java.