CVE-2023-2597 : In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer.

Published 2023-05-22 12:15:10

Updated 2024-06-21 19:15:26

Source Eclipse Foundation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-2597

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-2597

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.0	HIGH	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.0	5.9	Eclipse Foundation
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	3.9	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2023-2597

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: emo@eclipse.org (Secondary)

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-2597

https://github.com/eclipse-openj9/openj9/pull/17259

Add check for string length in getCachedUTFString() by pshipton · Pull Request #17259 · eclipse-openj9/openj9 · GitHub
Patch
https://security.netapp.com/advisory/ntap-20240621-0006/

February 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security

CVEs referencing this url

Products affected by CVE-2023-2597

Eclipse » Openj9
Versions before (<) 0.38.0
cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2023-2597

Exploit prediction scoring system (EPSS) score for CVE-2023-2597

CVSS scores for CVE-2023-2597

CWE ids for CVE-2023-2597

References for CVE-2023-2597

Products affected by CVE-2023-2597