CVE-2021-41041 Code injection in Eclipse OpenJ9

What is CVE-2021-41041?

CVE-2021-41041 is a medium-severity code injection vulnerability in The Eclipse Foundation Eclipse OpenJ9, published on 27 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Weakness: CWE-908, CWE-843, CWE-252

Which versions are affected by CVE-2021-41041?

It affects 2 products.

Products include Eclipse Openj9, Oracle Java Se.

How do I fix CVE-2021-41041?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-41041 being exploited?

There is no known exploitation of CVE-2021-41041 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse OpenJ9

• CVE-2021-41035 Security feature bypass in Eclipse OMR Critical 9.8
• CVE-2020-27221 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2019-11772 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12547 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12549 Null dereference in Eclipse OpenJ9 Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jmjp-ppjm-p747, UBUNTU-CVE-2021-41041.