CVE-2024-22361: IBM Semeru Runtime Cryptographic Weakness

CVE-2024-22361 Overview

CVE-2024-22361 affects IBM Semeru Runtime, a distribution of OpenJDK packaged by IBM. The runtime uses cryptographic algorithms weaker than industry-accepted standards. An attacker who intercepts encrypted traffic or stored ciphertext can decrypt highly sensitive information protected by these algorithms. The flaw is tracked under IBM X-Force ID 281222 and falls under [CWE-327] for use of a broken or risky cryptographic algorithm.

The vulnerability impacts multiple long-term-support branches of the runtime across versions 8, 11, 17, and 21. Confidentiality is the primary concern, with no direct impact on integrity or availability.

Critical Impact
A network-positioned attacker can decrypt sensitive data protected by the affected runtime, exposing application secrets, credentials, and protected payloads.

Affected Products

IBM Semeru Runtime 8.0.302.0 through 8.0.392.0
IBM Semeru Runtime 11.0.12.0 through 11.0.21.0, and 17.0.1.0 through 17.0.9.0
IBM Semeru Runtime 21.0.1.0

Discovery Timeline

2024-02-10 - CVE-2024-22361 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22361

Vulnerability Analysis

The vulnerability stems from the runtime's reliance on cryptographic primitives that no longer meet contemporary strength requirements. Affected algorithms may include short key lengths, deprecated cipher modes, or hash functions vulnerable to collision and pre-image attacks. Applications running on the affected runtime inherit these weak defaults when they invoke the standard Java Cryptography Architecture (JCA) and Java Cryptography Extension (JCE) providers shipped with Semeru.

Because the issue lives inside the runtime, every Java application executing on a vulnerable Semeru build is exposed regardless of its own code quality. Data encrypted in transit or at rest using the affected providers can be recovered through cryptanalytic techniques against the weak algorithm. The flaw is classified under [CWE-327] (Use of a Broken or Risky Cryptographic Algorithm).

Root Cause

IBM Semeru Runtime ships with cryptographic provider configurations that permit or default to algorithms with insufficient strength. Operators relying on platform defaults inherit the weakness without explicit warning. The runtime does not enforce modern minimums such as AES-GCM with 256-bit keys, SHA-256 or stronger digests, and current TLS cipher suites.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker captures encrypted traffic or obtains protected ciphertext from logs, backups, or shared storage. They then apply cryptanalysis against the weak algorithm to recover plaintext. Targets include TLS sessions, signed tokens, encrypted database fields, and serialized objects sealed by the runtime's default providers.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the IBM X-Force Vulnerability #281222 for additional technical context.

Detection Methods for CVE-2024-22361

Indicators of Compromise

Java processes running java -version output matching Semeru builds in the 8.0.302.0–8.0.392.0, 11.0.12.0–11.0.21.0, 17.0.1.0–17.0.9.0, or 21.0.1.0 ranges.
TLS handshakes negotiating deprecated cipher suites such as RC4, 3DES, or export-grade ciphers originating from Semeru-hosted applications.
Unexpected access patterns against backup archives or log stores that contain ciphertext produced by affected runtimes.

Detection Strategies

Inventory all hosts running IBM Semeru Runtime and correlate installed versions against the affected ranges using software asset management or endpoint telemetry.
Inspect application configurations and java.security files for enabled algorithms that fall below current NIST recommendations.
Monitor outbound TLS connections from Java workloads and flag negotiations of legacy protocol versions or weak cipher suites.

Monitoring Recommendations

Forward Java application and JVM logs to a centralized analytics platform to track cryptographic provider initialization and algorithm selection.
Alert on installation or update events that introduce vulnerable Semeru builds onto production systems.
Track issuance of new TLS certificates or tokens generated by services running on affected runtimes for downstream rotation.

How to Mitigate CVE-2024-22361

Immediate Actions Required

Upgrade IBM Semeru Runtime to a fixed release as specified in the IBM Support Node Advisory #7116431.
Rotate cryptographic keys, TLS certificates, and tokens that were generated or protected by the vulnerable runtime.
Restrict network exposure of services running on affected runtimes until patching completes.

Patch Information

IBM has published fixed builds for each affected version branch. Apply the updates referenced in the IBM Support Node Advisory #7116431 and the IBM X-Force Vulnerability #281222. Validate the upgrade by confirming the runtime version with java -version after deployment.

Workarounds

Edit the java.security configuration to disable weak algorithms by adding deprecated ciphers and hashes to jdk.tls.disabledAlgorithms and jdk.certpath.disabledAlgorithms.
Force applications to use strong providers explicitly through code or JVM flags, such as requiring TLS 1.2 or higher and AES-GCM cipher suites.
Place sensitive workloads behind a TLS-terminating proxy that enforces modern cipher policies independent of the JVM defaults.

bash

# Example java.security hardening to disable weak algorithms
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, 3DES_EDE_CBC, MD5withRSA, DH keySize < 2048, EC keySize < 224, anon, NULL
jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, RSA keySize < 2048, DSA keySize < 2048