CVE-2023-5676

low-risk

Published 2023-11-15

In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.1/10 Medium

LOCAL / HIGH complexity

Affected Products (1)

Openj9

Affected Vendors

Eclipse

References (5)

Issue Tracking https://github.com/eclipse-openj9/openj9/pull/18085

Vendor Advisory https://gitlab.eclipse.org/security/cve-assignement/-/issues/13

Issue Tracking https://github.com/eclipse-openj9/openj9/pull/18085

Vendor Advisory https://gitlab.eclipse.org/security/cve-assignement/-/issues/13

https://security.netapp.com/advisory/ntap-20241108-0002/

/ 100

low-risk

Severity 11/34 · Low

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal