CVE-2022-40609
IBM SDK, Java Technology Edition code execution
8.1 High
IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.76%Up 1.7 points since Aug 3, 2023
What each source reports
CVE List Score used
IBM SDK, Java Technology Edition code execution
IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.
- Record
CVE-2022-40609- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2022-43883
IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.
- Record
EUVD-2022-43883- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2cf4-9q4p-f6wj
IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute...
IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.
- Record
GHSA-2cf4-9q4p-f6wj- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.
- Record
CVE-2022-40609- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVRHSA-2023:4103
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2023:4103- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:4160
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2023:4160- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2023:3406-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541)
- CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute arbitrary code on the system. (bsc#1213934)
- CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access. (bsc#1213475)
- CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482)
- CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481)
- CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479)
- CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of service. (bsc#1213474)
- CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. (bsc#1207922)
- CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK accessible data. (bsc#1213473)
- Record
SUSE-SU-2023:3406-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3441-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541)
- CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute arbitrary code on the system. (bsc#1213934)
- CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access. (bsc#1213475)
- CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482)
- CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481)
- CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479)
- CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of service. (bsc#1213474)
- CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. (bsc#1207922)
- CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK accessible data. (bsc#1213473)
- Record
SUSE-SU-2023:3441-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibmRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibm-demoRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibm-develRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibm-headlessRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibm-jdbcRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibm-pluginRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibm-srcRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibm-webstartRed Hat:enterprise_linux:8::supplementary From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1.el8_8 | 1:1.8.0.8.5-1.el8_8 |
java-1.8.0-ibmRed Hat:rhel_extras:7 From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1jpp.1.el7 | 1:1.8.0.8.5-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1jpp.1.el7 | 1:1.8.0.8.5-1jpp.1.el7 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibm-develRed Hat:rhel_extras:7 From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1jpp.1.el7 | 1:1.8.0.8.5-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1jpp.1.el7 | 1:1.8.0.8.5-1jpp.1.el7 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1jpp.1.el7 | 1:1.8.0.8.5-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 7 CVEs |
before 1:1.8.0.8.5-1jpp.1.el7 | 1:1.8.0.8.5-1jpp.1.el7 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-30.114.1 | 1.8.0_sr8.10-30.114.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-30.114.1 | 1.8.0_sr8.10-30.114.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-30.114.1 | 1.8.0_sr8.10-30.114.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP4 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP5 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 7 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 7.1 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmopenSUSE:Leap 15.4 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
java-1_8_0-ibmopenSUSE:Leap 15.5 From an advisory covering 8 CVEs |
before 1.8.0_sr8.10-150000.3.80.1 | 1.8.0_sr8.10-150000.3.80.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-40609 is a high vulnerability (CVSS 8.1) in Ibm Sdk, published August 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. No source names a fixed version.
References
ibm.com/support/pages/node/7017032
exchange.xforce.ibmcloud.com/vulnerabilities/236069
nvd.nist.gov/vuln/detail/CVE-2022-40609
github.com/advisories/GHSA-2cf4-9q4p-f6wj
access.redhat.com/errata/RHSA-2023:4103
Show 50 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2187435
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4103.json
cve.org/CVERecord?id=CVE-2022-40609
suse.com/support/update/announcement/2023/suse-su-20233406-1
bugzilla.suse.com/1214431