CVE-2022-21549 — Inconsistency Between Implementation and Documented Design in Corporation Java SE JDK AND JRE

CWE-1068 — Inconsistency Between Implementation and Documented Design8 documents8 sources

Severity

5.3MEDIUMNVD

EPSS

0.2%

top 54.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oracle Corporation Java SE JDK AND JRE Azul Zulu Debian Linux +4 more

Timeline

PublishedJul 19

Latest updateAug 4

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶CVEListV5oracle_corporation/java_se_jdk_and_jreOracle GraalVM Enterprise Edition:21.3.2, Oracle GraalVM Enterprise Edition:22.1.0, Oracle Java SE:17.0.3.1+2

▶NVDoracle/graalvm21.3.2, 22.1.0+1

▶NVDoracle/jdk17.0.3.1

▶NVDoracle/jre17.0.3.1

▶NVDazul/zulu17.34

Also affects: Debian Linux 11.0, Fedora 35, 36

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

GHSA-c786-7jf2-46w9: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2022-07-20

▶

OSV

CVE-2022-21549: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2022-07-19

▶

CVEList

CVE-2022-21549: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2022-07-19

▶

📋Vendor Advisories

Ubuntu

OpenJDK vulnerabilities↗2022-08-04

▶

Red Hat

OpenJDK: random exponentials issue (Libraries, 8283875)↗2022-07-19

▶

Oracle

Oracle Oracle Java SE Risk Matrix: Libraries — CVE-2022-21549↗2022-07-15

▶

Debian

CVE-2022-21549: openjdk-17 - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product o...↗2022

▶