Currently, only the latest release of the Java Version Manager for Windows is supported with active security patches and vulnerability mitigations.

DiamTek Java Version Manager (JVM) is engineered for enterprise developer workstations and managed corporate environments. The security perimeter is hardened against common Windows attack vectors, Local Privilege Escalation (LPE), and software supply chain tampering.

• Vulnerability Mitigated: Legacy automation utilities commonly write temporary elevation scripts (e.g. %TEMP%\elevate.bat or %TEMP%\admin.ps1) before executing Start-Process -Verb RunAs. This creates a critical Time-of-Check to Time-of-Use (TOCTOU) race window where an unprivileged local process can overwrite the temporary file before elevated execution, gaining NT AUTHORITY\SYSTEM or Administrator privileges.
• Architectural Defense: JVM completely eliminates intermediate temporary elevation scripts. All administrative operations (such as system registry updates in legacy mode or system directory cleanups) are executed purely in-memory via parameterized PowerShell arguments:

  Start-Process powershell -Verb RunAs -ArgumentList @(
      '-NoProfile', '-NonInteractive', '-Command',
      "[Environment]::SetEnvironmentVariable('JAVA_HOME', '$target', 'Machine')"
  )

• EDR Compliance: This design prevents CrowdStrike, Microsoft Defender for Endpoint, and SentinelOne from triggering heuristic script-drop alerts in %TEMP%.

• Vulnerability Mitigated: Incomplete downloads, transit corruption, CDN cache poisoning, or malicious mirror swapping.
• Architectural Defense:
  • Every remote JDK payload is cryptographically validated against vendor SHA256/SHA512 (and SHA1 for BellSoft Liberica) checksum endpoints using native .NET Cryptography APIs (System.Security.Cryptography.SHA256 / SHA512 / SHA1).
  • Checksum validation is strictly decoupled from interactive prompts: passing -y / --yes only suppresses confirmation dialogs and will never bypass integrity verification.
  • Bypassing checksum validation requires an explicit, intentional --skip-checksum (or --no-verify) flag for air-gapped or legacy mirrors without published hashes.

• Vulnerability Mitigated: Arbitrary shell command execution via untrusted project repository files (.java-version or .sdkmanrc).
• Architectural Defense:
  • Injected shell metacharacters (&, |, <, >) embedded in version strings (e.g., 21 & calc.exe) are strictly filtered out by the parsing pipeline using findstr /v "[&|<>]".
  • Malicious lines are discarded before reaching the subshell execution boundary.

• Vulnerability Mitigated: Legacy Windows setx.exe imposes a hard 1,024-character buffer limit on the PATH environment variable. Running setx on a workstation with a long PATH silently truncates the tail of the variable, corrupting system-wide software installations.
• Architectural Defense: All global and machine environment updates leverage infinite-length .NET environment APIs ([Environment]::SetEnvironmentVariable), completely bypassing setx.exe buffer overrun vulnerabilities.

• Vulnerability Mitigated: Unauthorized binary replacement or build injection.
• Architectural Defense: Official release binaries (standalone MSIs, portable ZIPs) are built in isolated GitHub Actions runners and cryptographically signed using GitHub's OIDC Sigstore attestation authority (actions/attest-build-provenance).
• Verification Command:

  gh attestation verify jvm-windows-1.0.1-x64.msi --owner DiamTek

• Vulnerability Mitigated: In-transit modification of self-updater payloads, malicious mirror spoofing, accidental or unauthorized rollbacks to older vulnerable versions, and script-locking denial-of-service.
• Architectural Defense:
  • [Stable] Channel: Pulls release artifacts and computes SHA-256 digests in-memory via System.Security.Cryptography.SHA256, strictly matching against signed upstream SHA256SUMS.txt manifests before replacing local files. Any hash deviation immediately aborts execution and purges temporary files.
  • [Nightly] Channel: Fetches the direct commit tip of main, parses semantic build stamps (JVM_BUILD), calculates the local SHA-256 fingerprint, and logs it in the audit trail.
  • Downgrade Safeguard: Both channels compare local JVM_BUILD integers against remote payloads. If a local workstation is running a build with an integer greater than the upstream target (local > remote), the updater halts execution ([ SKIP ] You are on a newer local build), preventing accidental regression.
  • Decoupled Ephemeral Runner: Executable replacement occurs via a detached runner script that polls for file handle release before atomic filesystem replacement, preventing partial write corruption.

If you discover a potential security vulnerability in DiamTek Java Version Manager, please report it through coordinated disclosure. Do not create public GitHub issues or forum discussions for security vulnerabilities.

1. GitHub Security Advisories (Preferred): Navigate to the repository's Private Vulnerability Reporting page to open a confidential report.
2. Direct Email: Send an encrypted or plaintext report to the project maintainer:
   • Contact: Alexéy Shishkin
   • Email: salexey09@gmail.com
3. Discord (Direct Message): Reach out directly to @thehawk01 on Discord for initial coordination.

To help us triage and reproduce the issue rapidly, please include:

• The exact build number (jvm version or cmd.exe /c "jvm.bat --version").
• Target operating system and environment (e.g., Windows 11 23H2, standard user account vs. admin).
• Step-by-step reproduction instructions or a minimal Proof of Concept (PoC) payload.
• Assessment of the potential impact (e.g., LPE, arbitrary file write, shell injection).

We take all security reports with utmost urgency:

← Back to Documentation Overview