Read the docs
TI-2019-08832 Aliases CVE-2019-11775GHSA-3x93-p299-w98q

Time-of-check time-of-use race condition in Eclipse OpenJ9

Priority LOW 35CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.

Why it matters now

EPSS 0.01468 73rd percentileScored 2026-11-07
Fix Fixed Eclipse OpenJ9 (The Eclipse Foundation): 0.15.0Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse OpenJ9before 0.15.00.15.0Patch availableCNA
  • Eclipse OpenJ9 VendorEclipse Foundation Affected before 0.15.0 Fixed in 0.15.0 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*before 0.15.0VulnerableEclipse Foundation
cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*5.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* Versions before 0.15.0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · CNA Eclipse OpenJ9 (The Eclipse Foundation) Fixed in 0.15.0

Red Hat 6 advisories

  • RHSA-2019:2737 Released 2019-09-11 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10
  • RHSA-2019:2592 Released 2019-09-03 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +3
  • RHSA-2019:2590 Released 2019-09-02 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux 8 Supplementary java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0, java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0, java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0 +5
Show 3 more Red Hat advisories
  • RHSA-2019:2585 Released 2019-09-02 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +3
  • RHSA-2019:2494 Released 2019-08-15 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +3
  • RHSA-2019:2495 Released 2019-08-15 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8 SupplementaryFixed RHSA-2019:2590
Red Hat Enterprise Linux Client Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux Server Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux Workstation Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Satellite 5.8 (RHEL v.6)Fixed RHSA-2019:2737

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11775
  2. 2026-10-03 Alias added: GHSA-3x93-p299-w98q

References

Advisory 7

  • TI-2026-06062 Out-of-bounds read in Eclipse OpenJ9 CVSS 4.0HIGH 8.7
  • TI-2021-09396 Missing initialization of resource in Eclipse OpenJ9 CVSS 3.1MEDIUM 6.5
  • TI-2018-09008 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
  • TI-2018-09006 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
  • TI-2021-17899 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for… CVSS 3.1CRITICAL 9.8
  • TI-2019-08829 Out-of-bounds write in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences