What it is about

Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE). Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• die Vertraulichkeit
• Integrität
• Verfügbarkeit zu gefährden

Am I affected?

Affected according to the BSI:

• IBM VIOS 3.1
• IBM Java
• IBM AIX 7.3
• IBM VIOS 4.1
• Debian Linux
• IBM WebSphere Service Registry and Repository 8.5
• IBM Tivoli Monitoring 6.3.0.7
• Amazon Linux 2
• IBM AIX 7.2
• IBM InfoSphere Information Server 11.7
• IBM DB2
• Open Source OpenJDK

and 48 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• IBM QRadar SIEM 7.5.0 UP10 IF01
• Dell NetWorker Runtime Environment 8.0.23
• IBM App Connect Enterprise 13.0.2.0
• IBM App Connect Enterprise 12.0.12.9
• Amazon Corretto 11.0.26.4.1
• Amazon Corretto 8.442.06.1
• IBM Sterling Connect:Direct 6.1.0.27
• IBM Sterling Connect:Direct 6.2.0.26
• IBM QRadar SIEM 7.5.0 UP11 IF01
• IBM Sterling Connect:Direct for Unix 6.1.0.4.iFix121
• IBM Sterling Connect:Direct for Unix 6.3.0.4.iFix004
• IBM Sterling Connect:Direct for Unix 6.4.0.1.iFix005

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.