Oracle Java SE and Oracle GraalVM JSSE flaw enables unauthorized data access and modification

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

• Oracle Java SE: affected versions are 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1.
• Oracle GraalVM for JDK: affected versions are 17.0.21 and 21.0.13.
• Oracle GraalVM Enterprise Edition: affected version is 21.3.20.
• Oracle states that releases outside the Premier Support or Extended Support phases were not tested for this vulnerability, and that earlier versions of affected releases are likely also affected. The status of unlisted branches, including later or parallel branches, is not established by this record. No exact fixed release is provided in the record or in the consulted advisory.

The vulnerability affects the JSSE component in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated remote attacker can supply data to APIs in the affected component; Oracle gives a web service that supplies data to those APIs as an example. Oracle states that the Java updates address the issue by distrusting a set of impacted intermediate CA certificates related to eMudhra. This points to certificate trust handling, but the public advisory does not disclose the exact validation condition, API operation, or complete exploit sequence. The issue also applies to Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code.

The vulnerability is reachable over the network through multiple protocols. The supplied assessment characterizes it as easily exploitable, requiring no authentication and no user interaction. Oracle specifically notes that APIs in JSSE can be reached through a web service that supplies data to those APIs. The stated applicability also includes sandboxed Java Web Start applications and sandboxed Java applets executing untrusted code. Available evidence does not establish whether a public exploit or active exploitation exists.

Successful exploitation can expose data accessible through the affected runtime and can permit unauthorized creation, deletion, or modification of that data. The record describes network reachability without authentication or user interaction and places the impact within the security authority of the affected system. The practical data exposure and privilege consequences depend on the service permissions and application context, which are not specified. The record does not identify an availability impact.

A service running an affected runtime may permit unauthorized access to critical data or unauthorized creation, deletion, or modification of data accessible to the application. Likely operational consequences include loss of data integrity, data disclosure, validation of unauthorized changes, and incident investigation. Organizations should prioritize network-facing services and client deployments that execute untrusted code in a Java sandbox. Available evidence does not establish a specific breach, victim, or availability impact.

1. Update Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition according to the Oracle Security Alert and the applicable Java SE patch availability instructions. Oracle directs customers to update to the latest Java version; the update addresses the issue by distrusting impacted intermediate CA certificates related to eMudhra.
2. If immediate updating is not possible, apply the mitigations recommended by Oracle in the advisory. The specific mitigation content is not reproduced because it is not supplied in the record.
3. Prioritize network-facing services using JSSE, web services that supply data to APIs in the component, and clients running sandboxed Java Web Start applications or sandboxed Java applets.
4. While patching is pending, reduce unnecessary network reachability to relevant services as a precaution. This is not a substitute for applying the vendor update.
5. Verify the deployment inventory after remediation and do not treat an unlisted release as automatically safe. Oracle states that earlier releases are likely also affected and recommends upgrading to supported versions.

1. Inventory Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition runtimes, and verify the version actually used by each service and client.
2. Identify applications using JSSE, especially web services or endpoints that pass untrusted data into APIs in the affected component.
3. Check workstations and applications that still use sandboxed Java Web Start applications or sandboxed Java applets to load and run code from untrusted sources.
4. Review certificate trust telemetry involving impacted intermediate CA certificates related to eMudhra as a precautionary check. This is not a vendor-confirmed IOC.
5. After remediation, verify that affected services and clients are running the intended updated runtime. Oracle does not provide a specific log event, IOC, or forensic signature; the absence of such evidence does not prove that a system is safe.