Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…
Priority HIGH 78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.77151 99th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | Java SE JDK and JRE | Oracle Java SE:17.0.2; Oracle Java SE:18; Oracle GraalVM Enterprise Edition:21.3.1; Oracle GraalVM Enterprise Edition:22.0.0.2 | — | No fix listed | CNA |
- Java SE JDK and JRE VendorOracle Affected Oracle Java SE:17.0.2; Oracle Java SE:18; Oracle GraalVM Enterprise Edition:21.3.1; Oracle GraalVM Enterprise Edition:22.0.0.2 Fixed in — No fix listed CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:* | 21.3.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:* | 22.0.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdk:17.0.2:*:*:*:*:*:*:* | 17.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdk:18:*:*:*:*:*:*:* | 18 | Vulnerable | Oracle |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:* Versions 21.3.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:* Versions 22.0.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdk:17.0.2:*:*:*:*:*:*:* Versions 17.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdk:18:*:*:*:*:*:*:* Versions 18 Vulnerable ·Oracle
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:e-series_santricity_os_controller:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:azul:zulu:15.38:*:*:*:*:*:*:* | 15.38 | Vulnerable | Azul |
| cpe:2.3:a:azul:zulu:17.32:*:*:*:*:*:*:* | 17.32 | Vulnerable | Azul |
| cpe:2.3:a:azul:zulu:18.28:*:*:*:*:*:*:* | 18.28 | Vulnerable | Azul |
- cpe:2.3:a:netapp:e-series_santricity_os_controller:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:azul:zulu:15.38:*:*:*:*:*:*:* Versions 15.38 Vulnerable ·Azul
- cpe:2.3:a:azul:zulu:17.32:*:*:*:*:*:*:* Versions 17.32 Vulnerable ·Azul
- cpe:2.3:a:azul:zulu:18.28:*:*:*:*:*:*:* Versions 18.28 Vulnerable ·Azul
Remediation
Red Hat 4 advisories
- RHSA-2022:1729 Released 2022-05-17 · Red Hat rating Importantjava-17-openjdk security update
- Red Hat CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.3.0.7-1.el9_0, java-17-openjdk-demo-slowdebug-1:17.0.3.0.7-1.el9_0, java-17-openjdk-devel-fastdebug-1:17.0.3.0.7-1.el9_0 +11
- Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.3.0.7-1.el9_0, java-17-openjdk-demo-1:17.0.3.0.7-1.el9_0, java-17-openjdk-devel-1:17.0.3.0.7-1.el9_0 +6
- RHSA-2022:1437 Released 2022-04-28 · Red Hat rating ImportantOpenJDK 17.0.3 security update for Windows Builds
- Red Hat Build of OpenJDK 17.0.3
- RHSA-2022:1436 Released 2022-04-28 · Red Hat rating ImportantOpenJDK 17.0.3 security update for Portable Linux Builds
- Red Hat Build of OpenJDK 17.0.3
Show 1 more Red Hat advisories
- RHSA-2022:1445 Released 2022-04-20 · Red Hat rating Importantjava-17-openjdk security and bug fix update
- Red Hat CodeReady Linux Builder (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.3.0.6-2.el8_5, java-17-openjdk-demo-slowdebug-1:17.0.3.0.6-2.el8_5, java-17-openjdk-devel-fastdebug-1:17.0.3.0.6-2.el8_5 +11
- Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.3.0.6-2.el8_5, java-17-openjdk-demo-1:17.0.3.0.6-2.el8_5, java-17-openjdk-devel-1:17.0.3.0.6-2.el8_5 +6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Oracle Java SE JDK and JRE — DSA-5128
6 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2022-05861 Improper access control in Oracle Java SE JDK and JREPriority MEDIUM 46
- TI-2022-05812 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…Priority LOW 36
- TI-2022-05880 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…Priority LOW 35
- Advisory ·
Oracle Java SE JDK and JRE — DSA-5131
6 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2022-05861 Improper access control in Oracle Java SE JDK and JREPriority MEDIUM 46
- TI-2022-05812 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…Priority LOW 36
- TI-2022-05880 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…Priority LOW 35
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of OpenJDK 17.0.3 | Fixed | RHSA-2022:1437 |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2022:1445 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2022:1729 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:1445 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:1729 |
Not affected: 6 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat build of OpenJDK 1.8
- Red Hat build of OpenJDK 11
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21449
- 2026-10-03 Alias added: GHSA-cj8x-r9fp-q656
- 2026-10-09 Fix available: RHSA-2022:1437 · Red Hat
- 2026-11-05 Affected versions changed · Red Hat
References
Advisory 16
- [oss-security] 20220428 CVE-2022-21449 and version reporting
- [oss-security] 20220428 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220428 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220428 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220428 Re: CVE-2022-21449 and version reporting
- https://security.netapp.com/advisory/ntap-20220429-0006/
- [oss-security] 20220429 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220430 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220430 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220430 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220430 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220430 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220501 Re: CVE-2022-21449 and version reporting
- [oss-security] 20220502 Re: CVE-2022-21449 and version reporting
- DSA-5128
- DSA-5131
More Oracle Graalvm vulnerabilities
- TI-2023-22374 Improper check for unusual conditions in Apple macOS KEVCVSS 3.1HIGH 8.8
- TI-2022-15084 Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets CVSS 3.1HIGH 7.5
- TI-2020-06291 Prototype pollution in y18n CVSS 3.1CRITICAL 9.8
- TI-2019-11704 HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVSS 3.1CRITICAL 9.8
- TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
- TI-2019-06949 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a… CVSS 3.1HIGH 7.5
Sources
- CVE-2022-21449 · CVE Program
- CVE-2022-21449 · NVD
- FIRST EPSS
- GHSA-cj8x-r9fp-q656 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-21449 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences