CVE-2018-2657 Denial of service in Java

Medium 5.3 Published 18 Jan 2018 Updated 3 Oct 2024

An unauthenticated attacker can cause a partial denial of service in Java SE and JRockit by supplying data to serialization APIs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-2657?

CVE-2018-2657 is a medium-severity denial of service vulnerability in Hp Xp7 Command View, published on 18 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u171 and 7u161; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Which versions are affected by CVE-2018-2657?

It affects 12 products.

Products include Hp Xp7 Command View, Hp Xp Command View, Hp Xp P9000 Command View, Oracle Jdk, Oracle Jre, Oracle Jrockit and 6 more.

How do I fix CVE-2018-2657?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-2657 being exploited?

There is no known exploitation of CVE-2018-2657 in the wild and no public exploit code.

All Hp Xp7 Command View vulnerabilities

Sources

Also known as GHSA-qq7j-frwj-qh26.