5.3

CVE-2022-21626

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Graalvm Version 20.3.7 SwEdition enterprise
Oracle ≫ Graalvm Version 21.3.3 SwEdition enterprise
Oracle ≫ Graalvm Version 22.2.0 SwEdition enterprise
Oracle ≫ Jdk Version 1.8.0 Update update341
Oracle ≫ Jdk Version 1.8.0 Update update345 SwEdition enterprise_performance_pack
Oracle ≫ Jdk Version 11.0.16.1
Oracle ≫ Jre Version 1.8.0 Update update341
Oracle ≫ Jre Version 1.8.0 Update update345 SwEdition enterprise_performance_pack
Oracle ≫ Jre Version 11.0.16.1
Fedoraproject ≫ Fedora Version 35
Fedoraproject ≫ Fedora Version 36
Netapp ≫ Cloud Secure Agent Version -
Netapp ≫ E-series Santricity Os Controller Version >= 11.0 <= 11.70.2
Netapp ≫ Oncommand Insight Version -
Netapp ≫ Santricity Storage Plugin Version - SwPlatform vcenter
Azul ≫ Zulu Version 6.49
Azul ≫ Zulu Version 7.56
Azul ≫ Zulu Version 8.64
Azul ≫ Zulu Version 11.58
Azul ≫ Zulu Version 13.50
Azul ≫ Zulu Version 15.42
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.91% 0.781
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Oracle 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-693 Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

https://security.gentoo.org/glsa/202401-25
https://www.oracle.com/security-alerts/cpuoct2022.html
Patch
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ARF4QF4N3X5GSFHXUBWARGLISGKJ33R/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QLQ7OD33W6LT3HWI7VYDFFJLV75Y73K/
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20221028-0012/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGMDNIHAA73BEX6XPA2IMXJSGOKKYE6/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PB3CIGOFG7CENUVVE4FFZT2HI5FO77XU/
Third Party Advisory
Mailing List