This vulnerability has previously been reported and is now being updated. Oracle Java SE, Java SE Embedded and JRockit are prone to a remote security vulnerability, which can be exploited over multiple protocols. This issue aﬀects the ‘JNDI’ component. This vulnerability aﬀects the following supported versions: Java SE: 6u201, 7u191, 8u182, 11; Java SE Embedded: 8u181; JRockit: R28.3.19. The vulnerability does not require authentication to be exploited. However, It is hard to exploit and several special conditions must be satisﬁed to exploit it.
This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the speciﬁed Component, e.g. through a web service which supplies data to the APIs.
Information Disclosure, Data modiﬁcation, Reduced performance
Updates are available. Follow vendor advisory for further details.
Or update to a non-vulnerable version. Following products are not aﬀected.
IBM Java 188.8.131.52
IBM Java 184.108.40.206
IBM Java 220.127.116.11
IBM Java 18.104.22.168
IBM Java 22.214.171.124