It was discovered that the ProcessImpl class implementation for the Windows platform in the Libraries component of OpenJDK did not properly perform escaping of special characters in arguments for the command to be started. This could possibly allow an attacker to cause an external process to be started with unexpected arguments.
This issue only affected OpenJDK for the Microsoft Windows platform. Linux builds were not affected by this issue.
Public via Oracle CPU October 2019:
Fixed in Oracle Java SE 13.0.1, 11.0.5, 8u231, and 7u241.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
OpenJDK-11 upstream commit:
OpenJDK-8 upstream commit:
OpenJDK-7 upstream commit: