Skip to content
Fencer Intel
medium 5.9

CVE-2018-1517 json

A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-servic…

published 8y ago modified 4mo ago also EUVD-2018-12096

cvss
5.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.9%
EPSS 3.9% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. IBM X-Force ID: 141681.

Patch / fix

  • java-1.7.1-ibm RHEL 6 EXTRAS, network satellite 5.7, network satellite 5.6 1:1.7.1.4.30-1jpp.2.el6_10
  • java-1.8.0-ibm RHEL 6 EXTRAS, network satellite 5.8 1:1.8.0.5.20-1jpp.1.el6_10
  • java-1.7.1-ibm RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-src RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-demo RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-jdbc RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-plugin RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-src RHEL 6 EXTRAS 1:1.7.1.4.30-1jpp.2.el6_10

red hat advisories RHSA-2018:2712RHSA-2018:2713RHSA-2018:2569RHSA-2018:2576RHSA-2018:2575RHSA-2018:2568

  • java-1_7_1-ibm SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +8 more 1.7.1_sr4.30-38.26.1
  • java-1_8_0-ibm SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +7 more 1.8.0_sr5.20-30.36.1
  • java-1_8_0-ibm SLE Module for Legacy 15 1.8.0_sr5.20-3.6.2
  • java-1_7_1-ibm SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 1.7.1_sr4.30-26.29.1
  • java-1_7_0-ibm SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 1.7.0_sr10.30-65.28.1

suse advisories SUSE-SU-2018:2649-2SUSE-SU-2018:2839-2SUSE-SU-2018:3082-1SUSE-SU-2018:2839-1SUSE-SU-2018:2649-1SUSE-SU-2018:2583-1

Is CVE-2018-1517 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1517 updated cvss 7.5

JDK: DoS in the java.math component

  • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-demo 1.8.0.5.20-1jpp.1.el7
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-demo 1.8.0.5.20-1jpp.1.el6_10 Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more
    fixed: vendor fix RHSA-2018:2576
  • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more
    fixed: vendor fix RHSA-2018:2576
  • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10 Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10
    fixed: vendor fix RHSA-2018:2712
  • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10
    fixed: vendor fix RHSA-2018:2713

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.93% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 5.9 CVSS:3.0/A:H/AC:H/AV:N/C:N/I:N/PR:N/S:U/UI:N/E:U/RC:C/RL:O
CNA 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • IBM SDK, Java Technology Edition

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.