Skip to content
Fencer Vulns
high 7.8

CVE-2018-12539 json

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM…

published 2018-08-14 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-4504

cvss
7.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no.

Patch / fix

  • java-1.7.1-ibm RHEL 6 EXTRAS, network satellite 5.7, network satellite 5.6 1:1.7.1.4.30-1jpp.2.el6_10
  • java-1.8.0-ibm RHEL 6 EXTRAS, network satellite 5.8 1:1.8.0.5.20-1jpp.1.el6_10
  • java-1.7.1-ibm RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-src RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-demo RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-jdbc RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-plugin RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-src RHEL 6 EXTRAS 1:1.7.1.4.30-1jpp.2.el6_10

red hat advisories RHSA-2018:2712RHSA-2018:2713RHSA-2018:2569RHSA-2018:2576RHSA-2018:2575RHSA-2018:2568

  • java-1_7_1-ibm SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +8 more 1.7.1_sr4.30-38.26.1
  • java-1_8_0-ibm SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +7 more 1.8.0_sr5.20-30.36.1
  • java-1_8_0-ibm SLE Module for Legacy 15 1.8.0_sr5.20-3.6.2
  • java-1_7_1-ibm SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 1.7.1_sr4.30-26.29.1
  • java-1_7_0-ibm SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 1.7.0_sr10.30-65.28.1

suse advisories SUSE-SU-2018:2649-2SUSE-SU-2018:2839-2SUSE-SU-2018:3082-1SUSE-SU-2018:2839-1SUSE-SU-2018:2649-1SUSE-SU-2018:2583-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-12539 updated cvss 8.4

JDK: privilege escalation via insufficiently restricted access to Attach API

  • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-demo 1.8.0.5.20-1jpp.1.el7
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-demo 1.8.0.5.20-1jpp.1.el6_10 Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more
    fixed: vendor fix RHSA-2018:2576
  • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more
    fixed: vendor fix RHSA-2018:2576
  • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10 Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10
    fixed: vendor fix RHSA-2018:2712
  • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10
    fixed: vendor fix RHSA-2018:2713

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • The Eclipse Foundation Eclipse OpenJ9

Classification

Weakness
  • CWE-419 Unprotected Primary Channel
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.