Read the docs
TI-2018-08998 Aliases CVE-2018-12539GHSA-8xmg-5xjr-x475

Deserialization of untrusted data in Eclipse OpenJ9

Priority LOW 35CWE-419Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-502.

Summary

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no.

Why it matters now

EPSS 0.00494 42nd percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse OpenJ90.8—No fix listedCNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:openj9:0.8:*:*:*:*:*:*:*0.8VulnerableEclipse Foundation
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*13.2.0.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*13.3.0.0.0VulnerableOracle
  • cpe:2.3:a:eclipse:openj9:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:* Versions 13.2.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:* Versions 13.3.0.0.0 Vulnerable ·Oracle

Remediation

Red Hat 6 advisories

  • RHSA-2018:2713 Released 2018-09-17 · Red Hat rating Moderate
    java-1.8.0-ibm security update
    • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el6_10
  • RHSA-2018:2712 Released 2018-09-17 · Red Hat rating Moderate
    java-1.7.1-ibm security update
    • Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10
    • Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10
  • RHSA-2018:2576 Released 2018-08-28 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +3
Show 3 more Red Hat advisories
  • RHSA-2018:2575 Released 2018-08-28 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el6_10 +3
  • RHSA-2018:2569 Released 2018-08-27 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.1.el7 +3
  • RHSA-2018:2568 Released 2018-08-27 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.20-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el7 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Client Supplementary (v. 7)Fixed RHSA-2018:2568, RHSA-2018:2569
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)Fixed RHSA-2018:2568, RHSA-2018:2569
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2018:2575, RHSA-2018:2576
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)Fixed RHSA-2018:2575, RHSA-2018:2576
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2018:2575, RHSA-2018:2576
Red Hat Enterprise Linux Server Supplementary (v. 7)Fixed RHSA-2018:2568, RHSA-2018:2569
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2018:2575, RHSA-2018:2576
Red Hat Enterprise Linux Workstation Supplementary (v. 7)Fixed RHSA-2018:2568, RHSA-2018:2569
Red Hat Satellite 5.6 (RHEL v.6)Fixed RHSA-2018:2712
Red Hat Satellite 5.7 (RHEL v.6)Fixed RHSA-2018:2712
Red Hat Satellite 5.8 (RHEL v.6)Fixed RHSA-2018:2713

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12539
  2. 2026-10-03 Alias added: GHSA-8xmg-5xjr-x475

References

Patch 1

Advisory 7

  • TI-2026-06062 Out-of-bounds read in Eclipse OpenJ9 CVSS 4.0HIGH 8.7
  • TI-2021-09396 Missing initialization of resource in Eclipse OpenJ9 CVSS 3.1MEDIUM 6.5
  • TI-2018-09008 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
  • TI-2018-09006 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
  • TI-2021-17899 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for… CVSS 3.1CRITICAL 9.8
  • TI-2019-08829 Out-of-bounds write in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences