CVE-2019-17631 Missing authorization in Eclipse OpenJ9

Critical 9.1 Published 17 Oct 2019 Updated 5 Aug 2024

Attackers can perform privileged diagnostic operations like triggering garbage collection or creating files without authentication in Eclipse OpenJ9.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-17631?

CVE-2019-17631 is a critical missing authorization vulnerability in Redhat Enterprise Linux, published on 17 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.

Weakness: CWE-269, CWE-285

Which versions are affected by CVE-2019-17631?

It affects 7 products.

Products include Eclipse Openj9, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation and 1 more.

How do I fix CVE-2019-17631?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-17631 being exploited?

There is no known exploitation of CVE-2019-17631 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as GHSA-gf63-cjpr-3c75.