CVE-2024-20955: 
Oracle JRE vulnerability analysis and mitigation

A vulnerability has been identified in Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition's Compiler component. The affected versions include Oracle GraalVM for JDK versions 17.0.9 and 21.0.1, as well as Oracle GraalVM Enterprise Edition versions 20.3.12, 21.3.8, and 22.3.4. This vulnerability was disclosed in January 2024 (Oracle CPU).

The vulnerability is classified with a CVSS 3.1 Base Score of 3.7 (Low severity). The CVSS vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with high attack complexity, no privileges required, and no user interaction needed. The vulnerability primarily impacts confidentiality, with no effects on integrity or availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition accessible data. The impact is limited to confidentiality breaches, with no reported effects on system integrity or availability (Oracle CPU).

The vulnerability is characterized as difficult to exploit, requiring an unauthenticated attacker with network access via multiple protocols. Despite requiring no authentication, the high attack complexity suggests significant technical expertise would be needed for successful exploitation (Oracle CPU).

Oracle has released security patches to address this vulnerability through its January 2024 Critical Patch Update. Users are strongly advised to update to the latest patched versions of the affected software (Oracle CPU).