« Volver al listado

CVE-2021-41041

Estado: ModificadaMedia (5.3)—

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Eclipse — Openj9Oracle — Java SE

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-41041",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "emo@eclipse.org",
      "affectedData": [
        {
          "vendor": "The Eclipse Foundation",
          "product": "Eclipse OpenJ9",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "0.32.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-27T02:15:38.730",
  "references": [
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=579744",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://github.com/eclipse-openj9/openj9/pull/14935",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=579744",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/eclipse-openj9/openj9/pull/14935",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "emo@eclipse.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-252"
        },
        {
          "lang": "en",
          "value": "CWE-843"
        },
        {
          "lang": "en",
          "value": "CWE-908"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-252"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles."
    },
    {
      "lang": "es",
      "value": "En Eclipse Openj9 versiones anteriores a 0.32.0, Java 8 y 11 no lanzan la excepción capturada durante la verificación del código de bytes cuando la verificación es desencadenada por una invocación de MethodHandle, permitiendo invocar métodos no verificados mediante MethodHandles"
    }
  ],
  "lastModified": "2026-06-17T04:07:47.717",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92D694D4-DC59-4857-B2D3-CCFE7A2A794E",
              "versionEndExcluding": "0.32.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:java_se:8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D62706F-27A5-4BA7-B073-DCD2137A6063"
            },
            {
              "criteria": "cpe:2.3:a:oracle:java_se:11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E34D70BC-EBC8-4728-A8D6-B5A83DB97135"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "emo@eclipse.org"
}