CVE-2021-28167 Information disclosure in Eclipse OpenJ9

What is CVE-2021-28167?

CVE-2021-28167 is a medium-severity vulnerability in The Eclipse Foundation Eclipse OpenJ9, published on 21 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method, and may allow a user to observe uninitialized values.

Weakness: CWE-909

Which versions are affected by CVE-2021-28167?

It affects 1 product.

Products include Eclipse Openj9.

How do I fix CVE-2021-28167?

No fix has been published for CVE-2021-28167 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-28167 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-28167 exists.

Other vulnerabilities in The Eclipse Foundation Eclipse OpenJ9

• CVE-2021-41035 Security feature bypass in Eclipse OMR Critical 9.8
• CVE-2020-27221 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2019-11772 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12547 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12549 Null dereference in Eclipse OpenJ9 Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wmhf-m2r4-mcrp.