Security readout for executives and security teams
Plain-English summary
CVE-2019-11772 is a memory-safety flaw in Eclipse OpenJ9 before 0.15. Certain Java string byte-copy operations compiled by the JIT may skip null and bounds checks, allowing writes outside the intended byte array under a SecurityManager. That can undermine Java isolation in affected runtimes.
Executive priority
Treat as a targeted remediation item for Java estates using OpenJ9. It is not KEV-listed in the provided sources, but the potential impact on Java sandbox boundaries makes outdated OpenJ9 deployments worth finding and upgrading promptly.
Technical view
OpenJ9 JIT compilation of String.getBytes(int, int, byte[], int) failed to validate a non-null destination array and destination bounds. The CVE describes arbitrary writes to any 32-bit address or past a byte array from Java code running under SecurityManager. CWE-787 applies.
Likely exposure
Exposure is limited to systems running Eclipse OpenJ9 prior to 0.15, including environments covered by the cited Red Hat advisories. Risk is higher where Java applications run untrusted or semi-trusted code under SecurityManager assumptions.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation. The described primitive is serious, but sources do not provide exploit maturity, required privileges beyond Java code execution, or affected downstream package details.
Researcher notes
The key constraint is JIT-compiled execution of a deprecated String.getBytes overload under SecurityManager. Sources do not include CVSS, exploit code, or detailed platform matrices. Validate exposure by runtime version and downstream vendor package status, not by product name alone.
Mitigation direction
- Identify all Eclipse OpenJ9 runtimes and versions in production and build images.
- Move affected OpenJ9 runtimes off versions prior to 0.15.
- Apply applicable Red Hat security advisories for vendor-packaged Java runtimes.
- Review vendor guidance before changing Java runtime packages.
- Reduce exposure of workloads executing untrusted Java code.
Validation and detection
- Inventory JVM vendor and version across hosts, containers, and CI images.
- Confirm no runtime reports Eclipse OpenJ9 below 0.15.
- Check package update history against the cited Red Hat advisories.
- Review applications that depend on SecurityManager isolation assumptions.
- Prioritize systems executing user-supplied or plugin Java code.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-11772 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=549075CVE reference · x_refsource_CONFIRM
- RHSA-2019:2585CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2019:2590CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2019:2592CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2019:2737CVE reference · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.