Information Exposure Affecting org.graalvm.sdk:graal-sdk package, versions [17.0.0,17.0.11) [21.0.0,21.0.3) [22.0.0,22.0.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGGRAALVMSDK-6616574
- published 17 Apr 2024
- disclosed 16 Apr 2024
- credit Unknown
Introduced: 16 Apr 2024
CVE-2024-20954 Open this link in a new tabHow to fix?
Upgrade org.graalvm.sdk:graal-sdk to version 17.0.11, 21.0.3, 22.0.1 or higher.
Overview
org.graalvm.sdk:graal-sdk is a high-performance JDK distribution designed to accelerate the execution of applications written in Java and other JVM languages along with support for JavaScript, Ruby, Python, and a number of other popular languages.
Affected versions of this package are vulnerable to Information Exposure due to a flaw in the Compiler component. An attacker can achieve unauthorized read access to a subset of accessible data by exploiting this vulnerability through network access via multiple protocols. This vulnerability is challenging to exploit without proper authentication.