Security Bulletin: CVE-2021-41041 may affect IBM® SDK, Java™ Technology Edition

Summary

CVE-2021-41041 was addressed in Eclipse OpenJ9 version 0.32

Vulnerability Details

CVEID:CVE-2021-41041
**DESCRIPTION:**Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by failing to throw the exception captured during bytecode verification when verification. By sending a specially-crafted request, an attacker could exploit this vulnerability to make unverified methods to be invoked using MethodHandles.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225398 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

8.0.0.0 - 8.0.7.6

Note: CVE-2021-41041 is not applicable to IBM SDK, Java Technology Edition on Solaris, HP-UX and Mac OS.

Remediation/Fixes

8.0.7.10

IBM SDK, Java Technology Edition releases can be downloaded, subject to the terms of the developerWorks license, from the Java Developer Center.

IBM customers requiring an update for an SDK shipped with an IBM product should contact IBM support, and/or refer to the appropriate product security bulletin.

Workarounds and Mitigations

None