Description Preview
This vulnerability, identified as CVE-2025-21502, affects multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The vulnerability is difficult to exploit but allows an unauthenticated attacker with network access via multiple protocols to compromise these systems. Successful attacks can result in unauthorized update, insert or delete access to some accessible data as well as unauthorized read access to a subset of accessible data. This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
Overview
The vulnerability is in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The affected versions are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. The vulnerability has a CVSS 3.1 Base Score of 4.8, indicating a medium severity level.
Remediation
As of now, there is no specific remediation provided for this vulnerability. Users are advised to monitor the official Oracle website and other trusted sources for any updates or patches that may be released to address this vulnerability.
References
- Oracle Advisory: https://www.oracle.com/security-alerts/cpujan2025.html
- Netapp Security Advisory: https://security.netapp.com/advisory/ntap-20250124-0009/
- Openwall: http://www.openwall.com/lists/oss-security/2025/01/25/6
- Debian LTS Announcement: https://lists.debian.org/debian-lts-announce/2025/01/msg00031.html
- Debian LTS Announcement: https://lists.debian.org/debian-lts-announce/2025/02/msg00004.html
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing
- Health Care & Social AssistanceHealth Care & Social Assistance
- Public AdministrationPublic Administration
- Finance and InsuranceFinance and Insurance
- Transportation & WarehousingTransportation & Warehousing
- Educational ServicesEducational Services
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Retail TradeRetail Trade
- Other Services (except Public Administration)Other Services (except Public Administration)
- UtilitiesUtilities
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- InformationInformation
- Accommodation & Food ServicesAccommodation & Food Services
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- ConstructionConstruction
- MiningMining
- Wholesale TradeWholesale Trade
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
