CVE-2022-21360

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Severity
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Atk. Vector
NETWORK
Atk. Complexity
LOW
Priv. Required
NONE
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
VendorProductVersion
oraclegraalvm
20.3.4
oraclegraalvm
21.3.0
oraclejdk
1.7.0
oraclejdk
1.8.0
oraclejdk
11.0.13
oraclejdk
17.0.1
oraclejre
1.7.0
oraclejre
1.8.0
oraclejre
11.0.13
oraclejre
17.0.1
netapp7-mode_transition_tool
-
netappactive_iq_unified_manager
-
netappactive_iq_unified_manager
-
netappcloud_insights_acquisition_unit
-
netappcloud_secure_agent
-
netappe-series_santricity_os_controller
11.0.0 ≤
𝑥
≤ 11.70.1
netappe-series_santricity_storage_manager
-
netappe-series_santricity_web_services
-
netapphci_management_node
-
netapponcommand_insight
-
netapponcommand_workflow_automation
-
netappsantricity_storage_plugin
-
netappsantricity_unified_manager
-
netappsnapmanager
-
netappsnapmanager
-
netappsolidfire
-
debiandebian_linux
9.0
debiandebian_linux
10.0
debiandebian_linux
11.0
oracleopenjdk
11 ≤
𝑥
≤ 11.0.13
oracleopenjdk
13 ≤
𝑥
≤ 13.0.9
oracleopenjdk
15 ≤
𝑥
≤ 15.0.5
oracleopenjdk
17.0.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openjdk-11
bullseye
11.0.23+9-1~deb11u1
fixed
bullseye (security)
11.0.24+8-2~deb11u1
fixed
sid
11.0.24+8-2
fixed
openjdk-17
bullseye
17.0.11+9-1~deb11u1
fixed
bullseye (security)
17.0.12+7-2~deb11u1
fixed
bookworm
17.0.11+9-1~deb12u1
fixed
bookworm (security)
17.0.12+7-2~deb12u1
fixed
sid
17.0.12+7-2
fixed
trixie
17.0.12+7-2
fixed
openjdk-8
sid
8u422-b05-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
icedtea-web
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne
openjdk-12
noble
dne
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
dne
hirsute
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
openjdk-13
noble
dne
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
dne
hirsute
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
openjdk-15
noble
dne
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
dne
hirsute
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
openjdk-16
noble
dne
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
ignored
hirsute
ignored
focal
ignored
bionic
dne
xenial
dne
trusty
dne
openjdk-17
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
Fixed 17.0.2+8-1~22.10
released
hirsute
ignored
focal
Fixed 17.0.2+8-1~20.04
released
bionic
Fixed 17.0.2+8-1~18.04
released
xenial
dne
trusty
dne
openjdk-18
noble
dne
mantic
dne
lunar
ignored
kinetic
ignored
jammy
ignored
impish
ignored
hirsute
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
openjdk-8
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
Fixed 8u342-b07-0ubuntu1~22.04
released
impish
ignored
hirsute
ignored
focal
Fixed 8u342-b07-0ubuntu1~20.04
released
bionic
Fixed 8u342-b07-0ubuntu1~18.04
released
xenial
Fixed 8u342-b07-0ubuntu1~16.04
released
trusty
dne
openjdk-9
noble
dne
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
dne
hirsute
dne
focal
dne
bionic
dne
xenial
ignored
trusty
dne
openjdk-lts
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
Fixed 11.0.14+9-0ubuntu2~22.10
released
hirsute
ignored
focal
Fixed 11.0.14+9-0ubuntu2~20.04
released
bionic
Fixed 11.0.14+9-0ubuntu2~18.04
released
xenial
dne
trusty
dne