Red Hat Security Advisory

RHSA-2022:0204

java-11-openjdk security update

Released 2022-01-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) java-11-openjdk-1:11.0.14.0.9-1.el7_9, java-11-openjdk-headless-1:11.0.14.0.9-1.el7_9
Red Hat Enterprise Linux Client Optional (v. 7) java-11-openjdk-demo-1:11.0.14.0.9-1.el7_9, java-11-openjdk-devel-1:11.0.14.0.9-1.el7_9, java-11-openjdk-javadoc-1:11.0.14.0.9-1.el7_9 +4
Red Hat Enterprise Linux ComputeNode Optional (v. 7) java-11-openjdk-demo-1:11.0.14.0.9-1.el7_9, java-11-openjdk-devel-1:11.0.14.0.9-1.el7_9, java-11-openjdk-javadoc-1:11.0.14.0.9-1.el7_9 +4
Red Hat Enterprise Linux Server (v. 7) java-11-openjdk-1:11.0.14.0.9-1.el7_9, java-11-openjdk-devel-1:11.0.14.0.9-1.el7_9, java-11-openjdk-headless-1:11.0.14.0.9-1.el7_9
Red Hat Enterprise Linux Server Optional (v. 7) java-11-openjdk-demo-1:11.0.14.0.9-1.el7_9, java-11-openjdk-javadoc-1:11.0.14.0.9-1.el7_9, java-11-openjdk-javadoc-zip-1:11.0.14.0.9-1.el7_9 +3
Red Hat Enterprise Linux Workstation (v. 7) java-11-openjdk-1:11.0.14.0.9-1.el7_9, java-11-openjdk-devel-1:11.0.14.0.9-1.el7_9, java-11-openjdk-headless-1:11.0.14.0.9-1.el7_9
Red Hat Enterprise Linux Workstation Optional (v. 7) java-11-openjdk-demo-1:11.0.14.0.9-1.el7_9, java-11-openjdk-javadoc-1:11.0.14.0.9-1.el7_9, java-11-openjdk-javadoc-zip-1:11.0.14.0.9-1.el7_9 +3

Fixes 15 records

TI-2022-05732 CVE-2022-21341 · GHSA-m2jc-h86g-63rm

Deserialization of untrusted data in Oracle Java SE JDK and JRE

MEDIUM 57

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03765 Published 2022-01-19 Partial fix CWE-502

TI-2022-05731 CVE-2022-21340 · GHSA-78gw-5p6w-hw23

Uncontrolled resource consumption in Oracle Java SE JDK and JRE

MEDIUM 41

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.07748 Published 2022-01-19 Partial fix CWE-400

TI-2022-05684 CVE-2022-21293 · GHSA-xwxc-rh9r-2448

Uncontrolled resource consumption in Oracle Java SE JDK and JRE

MEDIUM 41

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.08346 Published 2022-01-19 Partial fix CWE-400

TI-2022-05674 CVE-2022-21283 · GHSA-g325-5mrh-jpx2

Protection mechanism failure in Oracle Java SE JDK and JRE

LOW 37

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03782 Published 2022-01-19 Partial fix CWE-693

TI-2022-05756 CVE-2022-21366 · GHSA-hgv5-w5qv-cpfg

Uncontrolled resource consumption in Oracle Java SE JDK and JRE

LOW 36

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03216 Published 2022-01-19 Fixed CWE-400

TI-2022-05755 CVE-2022-21365 · GHSA-g272-mw8v-rcqj

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…

LOW 36

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03486 Published 2022-01-19 Partial fix

TI-2022-05750 CVE-2022-21360 · GHSA-crw7-qg66-gv9w

Uncontrolled resource consumption in Oracle Java SE JDK and JRE

LOW 36

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03486 Published 2022-01-19 Partial fix CWE-400

TI-2022-05690 CVE-2022-21299 · GHSA-9j45-cjg7-r8w4

Uncontrolled resource consumption in Oracle Java SE JDK and JRE

LOW 36

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03458 Published 2022-01-19 Partial fix CWE-400

TI-2022-05685 CVE-2022-21294 · GHSA-rjph-cvj3-vf23

Resource allocation without limits in Oracle Java SE JDK and JRE

LOW 36

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0335 Published 2022-01-19 Partial fix CWE-770

TI-2022-05668 CVE-2022-21277 · GHSA-fh88-rxj8-f46q

Uncontrolled resource consumption in Oracle Java SE JDK and JRE

LOW 36

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03091 Published 2022-01-19 Fixed CWE-400

TI-2022-05696 CVE-2022-21305 · GHSA-w84w-x3w7-4xp3

Improper access control in Oracle Java SE JDK and JRE

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02755 Published 2022-01-19 Partial fix CWE-284

TI-2022-05687 CVE-2022-21296 · GHSA-cjp9-fpg3-7wj6

Information disclosure in Oracle Java SE JDK and JRE

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02825 Published 2022-01-19 Partial fix CWE-200

TI-2022-05682 CVE-2022-21291 · GHSA-7fgq-gfjm-hcr8

Improper access control in Oracle Java SE JDK and JRE

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02896 Published 2022-01-19 Fixed CWE-284

TI-2022-05673 CVE-2022-21282 · GHSA-vmgc-j3j3-w739

XML external entity injection in Oracle Java SE JDK and JRE

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02877 Published 2022-01-19 Partial fix CWE-611

TI-2022-05639 CVE-2022-21248 · GHSA-xhjw-g8c5-5cf5

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…

LOW 24

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03763 Published 2022-01-19 Partial fix