What is CVE-2019-17639?

CVE-2019-17639 is a medium-severity vulnerability in Eclipse Openj9, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 5.3/10. Published 2020-07-15.

How severe is CVE-2019-17639?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2019-17639 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Eclipse Openj9

CVE-2019-17639

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

EPSS: 0.015 (72.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Eclipse Openj9 — versions 0.21.0
The Eclipse Foundation Openj9 — versions <= 0.21

Weakness classification (CWE)

CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

emo@eclipse.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2019-17639?: CVE-2019-17639 is a medium-severity vulnerability in Eclipse Openj9, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 5.3/10. Published 2020-07-15.
How severe is CVE-2019-17639?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2019-17639 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.