CVE-2019-17631
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or...
9.1 Critical
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
2.07%Up 0.8 points since Apr 14, 2021
What each source reports
NVD Score used
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
- Record
CVE-2019-17631- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-285, CWE-269
- Updated
- 2026-11-02
CVE List No score
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
- Record
CVE-2019-17631- Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2019-7944 No score
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
- Record
EUVD-2019-7944- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gf63-cjpr-3c75 No score
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or...
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
- Record
GHSA-gf63-cjpr-3c75- Updated
- 2026-11-02
OSV
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
- Record
CVE-2019-17631- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:4113
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:4113- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2019:4115
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:4115- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0006
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2020:0006- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0046
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2020:0046- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2020:0001-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 6 [bsc#1158442, bsc#1154212]
- Security fixes: CVE-2019-2933 CVE-2019-2945 CVE-2019-2958 CVE-2019-2962 CVE-2019-2964 CVE-2019-2975 CVE-2019-2978 CVE-2019-2983 CVE-2019-2988 CVE-2019-2989 CVE-2019-2992 CVE-2019-2996 CVE-2019-2999 CVE-2019-2973 CVE-2019-2981 CVE-2019-17631
- Record
SUSE-SU-2020:0001-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0024-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 6 [bsc#1158442, bsc#1154212]
- Security fixes: CVE-2019-2933 CVE-2019-2945 CVE-2019-2958 CVE-2019-2962 CVE-2019-2964 CVE-2019-2975 CVE-2019-2978 CVE-2019-2983 CVE-2019-2988 CVE-2019-2989 CVE-2019-2992 CVE-2019-2996 CVE-2019-2999 CVE-2019-2973 CVE-2019-2981 CVE-2019-17631
- Record
SUSE-SU-2020:0024-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibmRed Hat:rhel_extras:6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibm-develRed Hat:rhel_extras:6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibmRed Hat:rhel_extras:7 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el7 | 1:1.8.0.6.0-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el7 | 1:1.8.0.6.0-1jpp.1.el7 |
java-1.8.0-ibm-develRed Hat:rhel_extras:7 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el7 | 1:1.8.0.6.0-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el7 | 1:1.8.0.6.0-1jpp.1.el7 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el7 | 1:1.8.0.6.0-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el7 | 1:1.8.0.6.0-1jpp.1.el7 |
java-1.8.0-ibmRed Hat:network_satellite:5.8::el6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibm-develRed Hat:network_satellite:5.8::el6 From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-1jpp.1.el6_10 | 1:1.8.0.6.0-1jpp.1.el6_10 |
java-1.8.0-ibmRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1.8.0-ibm-demoRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1.8.0-ibm-develRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1.8.0-ibm-headlessRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1.8.0-ibm-jdbcRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1.8.0-ibm-pluginRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1.8.0-ibm-srcRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1.8.0-ibm-webstartRed Hat:enterprise_linux:8::supplementary From an advisory covering 14 CVEs |
before 1:1.8.0.6.0-3.el8_1 | 1:1.8.0.6.0-3.el8_1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-3.30.1 | 1.8.0_sr6.0-3.30.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP1 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-3.30.1 | 1.8.0_sr6.0-3.30.1 |
java-1_8_0-ibmSUSE:HPE Helion OpenStack 8 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 7 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 8 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 5 From an advisory covering 16 CVEs |
before 1.8.0_sr6.0-30.60.1 | 1.8.0_sr6.0-30.60.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-17631 is a critical vulnerability (CVSS 9.1) in Eclipse Openj9, published October 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. No source names a fixed version.
References
bugs.eclipse.org/bugs/show_bug.cgi?id=552129
access.redhat.com/errata/RHSA-2019:4113
nvd.nist.gov/vuln/detail/CVE-2019-17631
Show 82 moreShow less
github.com/advisories/GHSA-gf63-cjpr-3c75
bugzilla.redhat.com/show_bug.cgi?id=1760963
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4113.json
cve.org/CVERecord?id=CVE-2019-2945
oracle.com/security-alerts/cpuoct2019.html
suse.com/support/update/announcement/2020/suse-su-20200001-1
bugzilla.suse.com/1154212