CVE-2022-21365

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

References

Affected packages

Debian:11 / openjdk-11

Package

Name: openjdk-11
Purl: pkg:deb/debian/openjdk-11?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

11.0.14+9-1~deb11u1

Affected versions

11.*

11.0.12+7-2

11.0.13+8-1~deb10u1

11.0.13+8-1~deb11u1

11.0.13+8-1

11.0.14+9-1~deb10u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / openjdk-17

Package

Name: openjdk-17
Purl: pkg:deb/debian/openjdk-17?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.2+8-1~deb11u1

Affected versions

Other

17~19-1

17~24-1

17~27-1

17~29-1

17~31ea-1

17~33ea-1

17~35ea-1

17+35-1

17.*

17.0.1+12-1

17.0.1+12-1+deb11u1

17.0.1+12-1+deb11u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / openjdk-17

Package

Name: openjdk-17
Purl: pkg:deb/debian/openjdk-17?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.2+8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / openjdk-17

Package

Name: openjdk-17
Purl: pkg:deb/debian/openjdk-17?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.2+8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/graalvm/graalvm-ce-builds

Affected ranges

Type: GIT
Repo: https://github.com/graalvm/graalvm-ce-builds
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

2b9eb103d1668cf5eac22fe85bdad7513681d9e3

Last affected

9e3645fe9e0c84e1350c4b88cfb9fdf432c97fce

Type: GIT
Repo: https://github.com/openjdk/jdk
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

0620440d1f92448c18cedb790913579beaff19d8

Last affected

0bd0f10d2c5965369490624627f16a39d35c8734

Last affected

0d3829a2c5a70961ffc539865adc1442c1a30bb1

Last affected

13ad3ed8b99f8c872eebb5d0bb647d5bb44ea0b5

Last affected

1408dbfdbe550dcdea4cb9a849fab6cb371ded18

Last affected

1c11f83e9262d3bf07b9d095a7b1d3659f1f2a9e

Last affected

22e500e3a917594cd93baaf8b5c7d29360d250d1

Last affected

27cab0e0c87f124277c7afeb5dd6a8750443804e

Last affected

34063e3656db6d0cadb9168f37024e6e66fc2372

Last affected

38378b7ee032d70653b3f0d4205f2305cf4f1170

Last affected

38930ae468910fb1d763f18c1d9473beffa7f3cb

Last affected

423befc9a0123b2cf13041f8acbb2a0000ddccdc

Last affected

493ac9ee8f9c4fb66b687bd740b8e1fb5ee8b86a

Last affected

6412341d454eee8a151cf89b51cabfb7b3d87140

Last affected

69efabad3d8a2ff47a62a4626c574a56edec1cfd

Last affected

6c04fd835e86522d2136ee663e19cfd5f71b9aa8

Last affected

7517b9d19367e1f057e5450d7871135b5f878d02

Last affected

7588f37667fd2a8c00d9a1a6e1afc605b75e0dc2

Last affected

75c48b0d1b36d9361a412ee2db2f51b7d9b6ef1c

Last affected

7ba83041b1d65545833655293d0976dfd1ffdea8

Last affected

7c18f827d7f096cbeb96b086a8516754f0c70221

Last affected

7ff3916e57ab852014885c3e7bdb95e5c1ed8c1e

Last affected

81ecd2932e0caee8ed01955fccc9e958c6a5cda3

Last affected

8261ee6da3c5843806c20808cc4206c73bb0efac

Last affected

82d185e64838992b019c90133d508d479d5ced0a

Last affected

880e09412543af479bc335faeda6196489a2a045

Last affected

88b37fb2a8aecf2b0afa75904d212da11919aa98

Last affected

925752098ba63b25c1cb635f50a53684d4094f8b

Last affected

b4b746fb274cb65f8cbf4a884bb20749a8f35d2b

Last affected

ba79b2bcce1ceefdeb44bb7075bc5d2647a56834

Last affected

bd04d75035a888d5034c5f7e2e0508d1d28d14af

Last affected

c1ff9b2e3b5e31e5874ca7d7a38ea4fbd9bbdd5d

Last affected

cfa6e0878b1aff48b521ee21d2598abe7f4964c2

Last affected

d08e6435e4026542e4d4bffdf12748e83ef0f9fb

Last affected

d38a1f186d640dede9fccb727ec98db3a413f9d8

Last affected

d49120d46668eaaab9df465a9ee17b696cb4e37f

Last affected

dfacda488bfbe2e11e8d607a6d08527710286982

Last affected

e21ea57f72b20424ac38930bcf56513cd42642e5

Last affected

e514f9072fc6ea3d2ad4e9a81251bf1fc1ed1eb6

Last affected

e7187d14db3748428c4a312203549f7ee31d4471

Last affected

e7d87b234c444e39369e8575284f785c56113324

Last affected

e9a2e84e45e1120aa306a01dfb087200f6a7f903

Last affected

ed6697aa20e3f9c17a496a544b10bfe3543de38f

Type: GIT
Repo: https://github.com/openjdk/jdk15u
Events: Introduced

4a588d89f01a650d90432cc14697a5a2ae2c97d3

Last affected

0fa171bd82048dae22daf3bc434cba2af57e7dd9

Type: GIT
Repo: https://github.com/openjdk/jdk8u
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

772d2a8fc0f3a6ae5dfcb1cbffc40a7999349bc6

Last affected

9205c421f33fd1938450d211369d3e2b7aec573d

Affected versions

Other

jdk-15+36

jdk-15-ga

jdk7-b100

jdk7-b101

jdk7-b102

jdk7-b103

jdk7-b104

jdk7-b105

jdk7-b106

jdk7-b107

jdk7-b108

jdk7-b109

jdk7-b110

jdk7-b111

jdk7-b112

jdk7-b113

jdk7-b114

jdk7-b115

jdk7-b116

jdk7-b117

jdk7-b118

jdk7-b119

jdk7-b120

jdk7-b121

jdk7-b122

jdk7-b123

jdk7-b124

jdk7-b125

jdk7-b126

jdk7-b127

jdk7-b128

jdk7-b129

jdk7-b130

jdk7-b131

jdk7-b132

jdk7-b133

jdk7-b134

jdk7-b135

jdk7-b136

jdk7-b137

jdk7-b138

jdk7-b139

jdk7-b140

jdk7-b141

jdk7-b142

jdk7-b143

jdk7-b144

jdk7-b145

jdk7-b146

jdk7-b147

jdk7-b24

jdk7-b25

jdk7-b26

jdk7-b27

jdk7-b28

jdk7-b29

jdk7-b30

jdk7-b31

jdk7-b32

jdk7-b33

jdk7-b34

jdk7-b35

jdk7-b36

jdk7-b37

jdk7-b38

jdk7-b39

jdk7-b40

jdk7-b41

jdk7-b42

jdk7-b43

jdk7-b44

jdk7-b45

jdk7-b46

jdk7-b47

jdk7-b48

jdk7-b49

jdk7-b50

jdk7-b51

jdk7-b52

jdk7-b53

jdk7-b54

jdk7-b55

jdk7-b56

jdk7-b57

jdk7-b58

jdk7-b59

jdk7-b60

jdk7-b61

jdk7-b62

jdk7-b63

jdk7-b64

jdk7-b65

jdk7-b66

jdk7-b67

jdk7-b68

jdk7-b69

jdk7-b70

jdk7-b71

jdk7-b72

jdk7-b73

jdk7-b74

jdk7-b75

jdk7-b76

jdk7-b77

jdk7-b78

jdk7-b79

jdk7-b80

jdk7-b81

jdk7-b82

jdk7-b83

jdk7-b84

jdk7-b85

jdk7-b86

jdk7-b87

jdk7-b88

jdk7-b89

jdk7-b90

jdk7-b91

jdk7-b92

jdk7-b93

jdk7-b94

jdk7-b95

jdk7-b96

jdk7-b97

jdk7-b98

jdk7-b99

jdk8-b01

jdk8-b02

jdk8-b03

jdk8-b04

jdk8-b05

jdk8-b06

jdk8-b07

jdk8-b08

jdk8-b09

jdk8-b10

jdk8-b100

jdk8-b101

jdk8-b102

jdk8-b103

jdk8-b104

jdk8-b105

jdk8-b106

jdk8-b107

jdk8-b108

jdk8-b109

jdk8-b11

jdk8-b110

jdk8-b111

jdk8-b112

jdk8-b113

jdk8-b114

jdk8-b115

jdk8-b116

jdk8-b117

jdk8-b118

jdk8-b119

jdk8-b12

jdk8-b120

jdk8-b121

jdk8-b13

jdk8-b14

jdk8-b15

jdk8-b16

jdk8-b17

jdk8-b18

jdk8-b19

jdk8-b20

jdk8-b21

jdk8-b22

jdk8-b23

jdk8-b24

jdk8-b25

jdk8-b26

jdk8-b27

jdk8-b28

jdk8-b29

jdk8-b30

jdk8-b31

jdk8-b32

jdk8-b33

jdk8-b34

jdk8-b35

jdk8-b36

jdk8-b37

jdk8-b38

jdk8-b39

jdk8-b40

jdk8-b41

jdk8-b42

jdk8-b43

jdk8-b44

jdk8-b45

jdk8-b46

jdk8-b47

jdk8-b48

jdk8-b49

jdk8-b50

jdk8-b51

jdk8-b52

jdk8-b53

jdk8-b54

jdk8-b55

jdk8-b56

jdk8-b57

jdk8-b58

jdk8-b59

jdk8-b60

jdk8-b61

jdk8-b62

jdk8-b63

jdk8-b64

jdk8-b65

jdk8-b66

jdk8-b67

jdk8-b68

jdk8-b69

jdk8-b70

jdk8-b71

jdk8-b72

jdk8-b73

jdk8-b74

jdk8-b75

jdk8-b76

jdk8-b77

jdk8-b78

jdk8-b79

jdk8-b80

jdk8-b81

jdk8-b82

jdk8-b83

jdk8-b84

jdk8-b85

jdk8-b86

jdk8-b87

jdk8-b88

jdk8-b89

jdk8-b90

jdk8-b91

jdk8-b92

jdk8-b93

jdk8-b94

jdk8-b95

jdk8-b96

jdk8-b97

jdk8-b98

jdk8-b99

jdk-15.*

jdk-15.0.1+1

jdk-15.0.1+2

jdk-15.0.1+3

jdk-15.0.1+4

jdk-15.0.1+5

jdk-15.0.1+6

jdk-15.0.1+7

jdk-15.0.1+8

jdk-15.0.1+9

jdk-15.0.1-ga

jdk-15.0.2+0

jdk-15.0.2+1

jdk-15.0.2+2

jdk-15.0.2+3

jdk-15.0.2+4

jdk-15.0.2+5

jdk-15.0.2+6

jdk-15.0.2+7

jdk-15.0.2-ga

jdk-15.0.3+0

jdk-15.0.3+1

jdk-15.0.3+2

jdk-15.0.3+3

jdk-15.0.3-ga

jdk-15.0.4+0

jdk-15.0.4+1

jdk-15.0.4+2

jdk-15.0.4+3

jdk-15.0.4+4

jdk-15.0.4+5

jdk-15.0.4-ga

jdk-15.0.5+0

jdk-15.0.5+1

jdk-15.0.5+2

jdk-15.0.5+3

jdk-15.0.5-ga

vm-19.*

vm-19.3.2

vm-19.3.2-pre

vm-19.3.3

vm-19.3.4

vm-19.3.5

vm-19.3.6

vm-20.*

vm-20.0.1

vm-20.1.0

vm-20.2.0

vm-20.3.0

vm-20.3.1

vm-20.3.1.2

vm-20.3.2

vm-20.3.3

vm-20.3.4

vm-21.*

vm-21.0.0

vm-21.0.0.2

vm-21.1.0

vm-21.2.0

vm-21.3.0