CVE-2022-21449

Опубликовано: 19 апр. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service

Ссылки

http://www.openwall.com/lists/oss-security/2022/04/28/2
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/28/3
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/28/4
Mailing List
http://www.openwall.com/lists/oss-security/2022/04/28/5
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/28/6
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/28/7
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/29/1
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/30/1
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/30/2
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/30/3
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/30/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/05/01/1
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/05/01/2
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/05/02/1
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220429-0006/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5128
Third Party Advisory
https://www.debian.org/security/2022/dsa-5131
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/04/28/2
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/28/3
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:jdk:17.0.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:18:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.0:*:*:*:*:*:*:*

cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:azul:zulu:15.38:*:*:*:*:*:*:*

cpe:2.3:a:azul:zulu:17.32:*:*:*:*:*:*:*

cpe:2.3:a:azul:zulu:18.28:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.24908

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2022-21449

CVSS3: 7.5

ubuntu

около 3 лет назад

CVE-2022-21449

CVSS3: 7.5

redhat

около 3 лет назад

CVE-2022-21449

CVSS3: 7.5

debian

около 3 лет назад

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition ...

GHSA-cj8x-r9fp-q656

CVSS3: 7.5

github

около 3 лет назад

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Componen...

BDU:2022-02516

CVSS3: 9.8

fstec

около 3 лет назад

Уязвимость реализации алгоритма цифровой подписи ECDSA программной платформы Oracle Java SE и виртуальной машины Oracle GraalVM Enterprise Edition, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность информации

EPSS

Процентиль: 96%

0.24908

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo