CVE-2023-21938

CWE-1589 documents8 sources
Severity
3.7LOW
EPSS
0.1%
top 75.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Oracle OpenjdkOracle Corporation Java SE JDK AND JREDebian Debian Linux+3 more
Timeline
PublishedApr 18
Latest updateMay 16

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages7 packages

▶NVDoracle/graalvm20.3.8, 21.3.4, 22.3.0+2
▶NVDoracle/openjdk11 — 11.0.18+4
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre4 versions+3

Also affects: Debian Linux 10.0, 11.0, 12.0

🔴Vulnerability Details

4
OSV
openjdk-8, openjdk-lts, openjdk-17, openjdk-20 vulnerabilities↗2023-05-16
▶
CVEList
CVE-2023-21938: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2023-04-18
▶
OSV
CVE-2023-21938: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2023-04-18
▶
GHSA
GHSA-9pqg-44mx-r5gr: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2023-04-18
▶

📋Vendor Advisories

4
Ubuntu
OpenJDK vulnerabilities↗2023-05-16
▶
Red Hat
OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304)↗2023-04-18
▶
Oracle
Oracle Oracle Java SE Risk Matrix: Libraries — CVE-2023-21938↗2023-04-15
▶
Debian
CVE-2023-21938: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product o...↗2023
▶
CVE-2023-21938 (LOW CVSS 3.7) | Vulnerability in the Oracle Java SE | cvebase.io