Search for vulnerabilities
Vulnerability details: VCID-jtu1-b8qu-aaac
Vulnerability ID VCID-jtu1-b8qu-aaac
Aliases CVE-2024-21085
Summary Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-789 Memory Allocation with Excessive Size Value
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21085.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00176 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00282 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00282 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00282 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00986 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21085.json
https://api.first.org/data/v1/epss?cve=CVE-2024-21085
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21011
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21012
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21068
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21085
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21094
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html
https://security.netapp.com/advisory/ntap-20240426-0004/
https://www.oracle.com/security-alerts/cpuapr2024.html
1069678 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069678
2275001 https://bugzilla.redhat.com/show_bug.cgi?id=2275001
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:data_infrastructure_insights_acquisition_unit:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:data_infrastructure_insights_acquisition_unit:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:data_infrastructure_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:data_infrastructure_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:java_se:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u401:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:8u401:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u401:*:*:*:enterprise_performance:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:8u401:*:*:*:enterprise_performance:*:*:*
cpe:2.3:a:oracle:jdk:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2024-21085 https://nvd.nist.gov/vuln/detail/CVE-2024-21085
RHSA-2024:1815 https://access.redhat.com/errata/RHSA-2024:1815
RHSA-2024:1816 https://access.redhat.com/errata/RHSA-2024:1816
RHSA-2024:1817 https://access.redhat.com/errata/RHSA-2024:1817
RHSA-2024:1818 https://access.redhat.com/errata/RHSA-2024:1818
RHSA-2024:1819 https://access.redhat.com/errata/RHSA-2024:1819
RHSA-2024:1820 https://access.redhat.com/errata/RHSA-2024:1820
RHSA-2024:1821 https://access.redhat.com/errata/RHSA-2024:1821
RHSA-2024:1822 https://access.redhat.com/errata/RHSA-2024:1822
USN-6810-1 https://usn.ubuntu.com/6810-1/
USN-6811-1 https://usn.ubuntu.com/6811-1/
USN-7096-1 https://usn.ubuntu.com/7096-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21085.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.16666
EPSS Score 0.00045
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-04-23T17:18:20.861843+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-21085 34.0.0rc4