CVE-2017-10102

critical

Published 2017-08-08 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

9.0

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

9.0

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Predictions

Exploit likelihood

93%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

OS	Version	Status	Fixed in
sles		affected
debian	sid	fixed	`8u141-b15-1`
debian	8.0	affected
debian	9.0	affected
rhel	6.0	affected
rhel	7.0	affected
rhel	7.3	affected
rhel	7.4	affected
rhel	7.5	affected
rhel	7.6	affected
rhel	7.7	affected

Application impact

Vendor	Product	Versions
oracle	jdk	`1.6.0`
oracle	jdk	`1.7.0`
oracle	jdk	`1.8.0`
oracle	jre	`1.6.0`
oracle	jre	`1.7.0`
oracle	jre	`1.8.0`
phoenixcontact	fl_mguard_dm	`{"endIncluding":"1.8.0"}`
netapp	active_iq_unified_manager	`{"startIncluding":"7.3"}`
netapp	cloud_backup	`-`
netapp	e-series_santricity_os_controller	`{"startIncluding":"11.0","endIncluding":"11.70.1"}`
netapp	e-series_santricity_storage_manager	`-`
netapp	element_software	`-`
netapp	oncommand_balance	`-`
netapp	oncommand_insight	`-`
netapp	oncommand_performance_manager	`-`
netapp	oncommand_shift	`-`
netapp	oncommand_unified_manager	`{"endIncluding":"7.1"}`
netapp	oncommand_unified_manager	`-`
netapp	plug-in_for_symantec_netbackup	`-`
netapp	snapmanager	`-`
netapp	steelstore_cloud_integrated_storage	`-`
netapp	storage_replication_adapter_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	storage_replication_adapter_for_clustered_data_ontap	`9.6`
netapp	vasa_provider_for_clustered_data_ontap	`{"startIncluding":"7.2"}`
netapp	vasa_provider_for_clustered_data_ontap	`6.0`
netapp	virtual_storage_console	`{"startIncluding":"7.2"}`
netapp	virtual_storage_console	`6.0`
redhat	satellite	`5.8`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.