{"id":"CVE-2022-21349","aliases":["ALPINE-CVE-2022-21349","BIT-java-2022-21349","BIT-java-min-2022-21349","BIT-jre-2022-21349","CLSA-2022-1661173656","CLSA-2022-1661176564","DLA-2917-1","EUVD-2022-26574","GHSA-mv36-g4g7-p396","OESA-2022-1786","SUSE-SU-2022:0871-1","SUSE-SU-2022:0873-1","SUSE-SU-2022:1025-1","SUSE-SU-2022:1026-1","SUSE-SU-2022:1027-1","SUSE-SU-2022:14926-1","SUSE-SU-2022:14927-1","UBUNTU-CVE-2022-21349","openSUSE-SU-2022:0873-1","openSUSE-SU-2022:1027-1","openSUSE-SU-2024:11895-1"],"status":"published","title":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03306,"percentile":0.88698,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-01-19T11:25:16Z","modified":"2026-11-03T07:30:17Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openjdk8","fixed_in":["8.322.06-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java","fixed_in":["1.7.0","1.8.0","7.0.331","8.0.321"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java-min","fixed_in":["1.7.0","1.8.0","7.0.331","8.0.321"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jre","fixed_in":["1.7.0","1.8.0","7.0.331","8.0.321"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openjdk-8","fixed_in":["8u342-b07-0ubuntu1~16.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-8","fixed_in":["8u342-b07-0ubuntu1~18.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-8","fixed_in":["8u342-b07-0ubuntu1~20.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-8","fixed_in":["8u342-b07-0ubuntu1~22.04"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openjdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.322.06-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"},{"introduced":"1.8.0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"7.0.331"},{"introduced":"8.0.0"},{"fixed":"8.0.321"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"},{"introduced":"1.8.0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"7.0.331"},{"introduced":"8.0.0"},{"fixed":"8.0.321"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jre","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"},{"introduced":"1.8.0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"7.0.331"},{"introduced":"8.0.0"},{"fixed":"8.0.321"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"Debian:9","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u322-b06-1~deb9u1"}]}],"versions":["8u131-b11-2","8u141-b15-1","8u141-b15-1~deb9u1","8u141-b15-2","8u141-b15-3","8u144-b01-1","8u144-b01-2","8u151-b12-1","8u151-b12-1~deb9u1","8u162-b12-1","8u162-b12-1~bpo8+1","8u162-b12-1~deb9u1","8u171-b11-1","8u171-b11-1~bpo8+1","8u171-b11-1~deb9u1","8u171-b11-2","8u181-b13-1","8u181-b13-1~deb9u1","8u181-b13-2","8u181-b13-2~deb9u1","8u191-b12-1","8u191-b12-2","8u202-b26-1","8u202-b26-2","8u202-b26-3","8u212-b01-1","8u212-b01-1~deb9u1","8u212-b03-1","8u212-b03-2","8u212-b03-2~deb9u1","8u222-b04-1","8u222-b04-3","8u222-b05-1","8u222-b07-1","8u222-b07-2","8u222-b07-3","8u222-b10-1","8u222-b10-1~deb9u1","8u232-b04-1","8u232-b07-1","8u232-b07-2","8u232-b09-1","8u232-b09-1~deb9u1","8u242-b04-1","8u242-b08-1","8u242-b08-1~deb9u1","8u252-b07-1","8u252-b09-1","8u252-b09-1~deb9u1","8u265-b01-0+deb9u1","8u265-b01-1","8u272-b10-0+deb9u1","8u272-b10-1","8u275-b01-1","8u275-b01-1~deb9u1","8u282-b08-2","8u292-b10-0+deb9u1","8u292-b10-1","8u292-b10-2","8u292-b10-3","8u302-b08-1","8u302-b08-1~deb9u1","8u312-b07-1","8u312-b07-1~deb9u1"],"bundled":13},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"openjdk-1.8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-1.8.0-openjdk-1.8.0.342.b07-0.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"openjdk-1.8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-1.8.0-openjdk-1.8.0.342.b07-0.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"openjdk-1.8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-1.8.0-openjdk-1.8.0.342.b07-0.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-27.72.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-38.68.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-30.87.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"java-1_7_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0_sr11.5-65.66.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.5-26.71.2"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u342-b07-0ubuntu1~16.04"}]}],"versions":["8u66-b01-5","8u72-b05-1ubuntu1","8u72-b05-5","8u72-b05-6","8u72-b15-1","8u72-b15-2ubuntu1","8u72-b15-2ubuntu3","8u72-b15-3ubuntu1","8u77-b03-1ubuntu2","8u77-b03-3ubuntu1","8u77-b03-3ubuntu2","8u77-b03-3ubuntu3","8u91-b14-0ubuntu4~16.04.1","8u91-b14-3ubuntu1~16.04.1","8u111-b14-2ubuntu0.16.04.2","8u121-b13-0ubuntu1.16.04.2","8u131-b11-0ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.3","8u151-b12-0ubuntu0.16.04.2","8u162-b12-0ubuntu0.16.04.2","8u171-b11-0ubuntu0.16.04.1","8u181-b13-0ubuntu0.16.04.1","8u181-b13-1ubuntu0.16.04.1","8u191-b12-0ubuntu0.16.04.1","8u191-b12-2ubuntu0.16.04.1","8u212-b03-0ubuntu1.16.04.1","8u222-b10-1ubuntu1~16.04.1","8u232-b09-0ubuntu1~16.04.1","8u242-b08-0ubuntu3~16.04","8u252-b09-1~16.04","8u265-b01-0ubuntu2~16.04","8u272-b10-0ubuntu1~16.04","8u275-b01-0ubuntu1~16.04","8u282-b08-0ubuntu1~16.04","8u292-b10-0ubuntu1~16.04.1","8u312-b07-0ubuntu1~16.04"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-1ubuntu2","1.5.3-0ubuntu1","1.6.1-1ubuntu2","1.6.1-3ubuntu1","1.6.1-4ubuntu1","1.6.2-1ubuntu1","1.6.2-2ubuntu1","1.6.2-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u342-b07-0ubuntu1~18.04"}]}],"versions":["8u144-b01-2","8u151-b12-1","8u162-b12-1","8u171-b11-0ubuntu0.18.04.1","8u181-b13-0ubuntu0.18.04.1","8u181-b13-1ubuntu0.18.04.1","8u191-b12-0ubuntu0.18.04.1","8u191-b12-2ubuntu0.18.04.1","8u212-b03-0ubuntu1.18.04.1","8u222-b10-1ubuntu1~18.04.1","8u232-b09-0ubuntu1~18.04.1","8u242-b08-0ubuntu3~18.04","8u252-b09-1~18.04","8u265-b01-0ubuntu2~18.04","8u272-b10-0ubuntu1~18.04","8u275-b01-0ubuntu1~18.04","8u282-b08-0ubuntu1~18.04","8u292-b10-0ubuntu1~18.04","8u312-b07-0ubuntu1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2-3.1ubuntu3","1.8-0ubuntu8~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u342-b07-0ubuntu1~20.04"}]}],"versions":["8u232-b09-0ubuntu1","8u232-b09-1","8u242-b04-1","8u242-b08-0ubuntu3","8u252-b07-1","8u252-b09-1ubuntu1","8u265-b01-0ubuntu2~20.04","8u272-b10-0ubuntu1~20.04","8u275-b01-0ubuntu1~20.04","8u282-b08-0ubuntu1~20.04","8u292-b10-0ubuntu1~20.04","8u312-b07-0ubuntu1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8-0ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u342-b07-0ubuntu1~22.04"}]}],"versions":["8u302-b08-0ubuntu2","8u312-b07-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-2","1.8.8-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-3","1.8.8-3build1","1.8.8-3ubuntu1","1.8.8-4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-3.64.2"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.5-150000.3.56.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-1_8_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.322-1.1"}]}],"bundled":13}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"7-mode_transition_tool"},{"vendor":"netapp","product":"cloud_insights"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"e-series_santricity_storage_manager"},{"vendor":"netapp","product":"e-series_santricity_web_services"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"santricity_unified_manager"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"netapp","product":"solidfire"},{"vendor":"oracle","product":"graalvm"},{"vendor":"oracle","product":"jdk"},{"vendor":"oracle","product":"jre"},{"vendor":"oracle","product":"openjdk"},{"vendor":"oracle corporation","product":"java se jdk and jre"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20220121-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://security.gentoo.org/glsa/202209-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21349","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mv36-g4g7-p396"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-21349","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1661173656.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1661176564.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21349.json","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220871-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193314","tags":["report"]},{"url":"https://bugzilla.suse.com/1193444","tags":["report"]},{"url":"https://bugzilla.suse.com/1193491","tags":["report"]},{"url":"https://bugzilla.suse.com/1194926","tags":["report"]},{"url":"https://bugzilla.suse.com/1194928","tags":["report"]},{"url":"https://bugzilla.suse.com/1194929","tags":["report"]},{"url":"https://bugzilla.suse.com/1194931","tags":["report"]},{"url":"https://bugzilla.suse.com/1194932","tags":["report"]},{"url":"https://bugzilla.suse.com/1194933","tags":["report"]},{"url":"https://bugzilla.suse.com/1194934","tags":["report"]},{"url":"https://bugzilla.suse.com/1194935","tags":["report"]},{"url":"https://bugzilla.suse.com/1194937","tags":["report"]},{"url":"https://bugzilla.suse.com/1194939","tags":["report"]},{"url":"https://bugzilla.suse.com/1194940","tags":["report"]},{"url":"https://bugzilla.suse.com/1194941","tags":["report"]},{"url":"https://bugzilla.suse.com/1195163","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21365","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220873-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221025-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194925","tags":["report"]},{"url":"https://bugzilla.suse.com/1194927","tags":["report"]},{"url":"https://bugzilla.suse.com/1194930","tags":["report"]},{"url":"https://bugzilla.suse.com/1196500","tags":["report"]},{"url":"https://bugzilla.suse.com/1197126","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21366","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221026-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195146","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221027-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214926-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214927-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21349","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21349","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4IS5FMKDHHRO4IBOMDW2TOCFQJ7BOXCY/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2EH4HQJU5VK7ZC3BHZTQT6QUXNTGNXVQ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-01-19T11:25:16Z","modified":"2024-09-24T20:20:19.898Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-26574","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-01-19T11:25:16Z","modified":"2024-09-24T20:20:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:13.49018Z"}],"ghsa":[{"id":"GHSA-mv36-g4g7-p396","title":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-02-11T00:01:40Z","modified":"2023-01-28T05:02:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T14:43:46.718397Z"}],"nvd":[{"id":"CVE-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-01-19T12:15:15.023Z","modified":"2026-06-17T04:26:05.32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:10.836864Z"}],"osv":[{"id":"ALPINE-CVE-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-01-19T12:15:15.023Z","modified":"2026-11-03T07:30:17.549128119Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-01-19T11:25:16Z","modified":"2026-10-28T02:30:48.377923112Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"OESA-2022-1786","title":"openjdk-1.8.0 security update","description":"The OpenJDK runtime environment 8.\r\n\r\nSecurity Fix(es):\r\n\r\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21349)\r\n\r\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2022-21540)\r\n\r\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2022-21541)\r\n\r\nThe Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.(CVE-2022-34169)","status":"published","published":"2022-07-30T11:05:03Z","modified":"2026-08-18T01:16:52.420254685Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-01-19T12:15:00Z","modified":"2026-10-17T12:56:16.654639006Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"BIT-java-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-05-06T14:43:05.668Z","modified":"2026-09-08T08:48:12.11069433Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-java-min-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-05-06T14:43:08.618Z","modified":"2026-09-08T08:47:54.665253273Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-jre-2022-21349","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-05-08T05:44:35.321Z","modified":"2026-09-08T08:48:05.086751608Z","updated_at":"2026-11-02T15:28:31.782692Z"},{"id":"CLSA-2022-1661173656","title":"Fixed 50 CVEs in java-1.7.0-openjdk","description":"- Bump to 2.6.28 and OpenJDK 7u351-b01.\n- Security fixes in 7u351:\n - CVE-2022-21540: Improve class compilation (JDK-8281859)\n - CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)\n - CVE-2022-34169: Improve Xalan supports (JDK-8285407)\n- Security fixes in 7u341:\n - CVE-2022-21426: Better XPath expression handling (JDK-8270504)\n - CVE-2022-21434: Better invocation handler handling (JDK-8277672)\n - CVE-2022-21443: Improved Object Identification (JDK-8275151)\n - CVE-2022-21476: Improve Santuario processing (JDK-8278008)\n - CVE-2022-21496: Improve URL supports (JDK-8278972)\n- Security fixes in 7u331:\n - CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)\n - CVE-2022-21282: Better resolution of URIs (JDK-8270492)\n - CVE-2022-21283: Better String matching (JDK-8268813)\n - CVE-2022-21293: Improve String constructions (JDK-8270392)\n - CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)\n - CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)\n - CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)\n - CVE-2022-21305: Better array indexing (JDK-8272014)\n - CVE-2022-21340: Verify Jar Verification (JDK-8272026)\n - CVE-2022-21341: Improve serial forms for transport (JDK-8272236)\n - CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)\n - CVE-2022-21360: Enhance BMP image support (JDK-8273756)\n - CVE-2022-21365: Enhanced BMP processing (JDK-8273838)\n- Security fixes in 7u321:\n - CVE-2021-35550: Update the default enabled cipher suites preference\n   (JDK-8163326)\n - CVE-2021-35556: Richer Text Editors (JDK-8265167)\n - CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)\n - CVE-2021-35561: Better hashing support (JDK-8266097)\n - CVE-2021-35564: Improve Keystore integrity (JDK-8266137)\n - CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close\n   (JDK-8254967)\n - CVE-2021-35586: Better BMP support (JDK-8267735)\n - CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if\n   InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)\n - CVE-2021-35603: Better session identification (JDK-8269618)\n- Security fixes in 7u311:\n - CVE-2021-2341: Improve file transfers (JDK-8258432)\n - CVE-2021-2369: Better jar file validation (JDK-8260967)\n - CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)\n- Security fixes in 7u301:\n - CVE-2021-2161: Less ambiguous processing (JDK-8250568)\n - CVE-2021-2163: Enhance opening JARs (JDK-8249906)\n- Security fixes in 7u281:\n - CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)\n - CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)\n - CVE-2020-14782: Enhance certificate processing (JDK-8237995)\n - CVE-2020-14792: Better range handling (JDK-8241114)\n - CVE-2020-14796: Improved URI Support (JDK-8242680)\n - CVE-2020-14797: Better Path Validation (JDK-8242685)\n - CVE-2020-14798: Enhanced buffer support (JDK-8242695)\n - CVE-2020-14803: Improved Buffer supports (JDK-8244136)\n- Security fixes in 7u271:\n - CVE-2020-14577: Enhance certificate verification (JDK-8237592)\n - CVE-2020-14578: NegativeArraySizeException in\n   sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)\n - CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)\n   (JDK-8028431)\n - CVE-2020-14581: Better matrix operations (JDK-8238002)\n - CVE-2020-14583: Better Buffer support (JDK-8238920)\n - CVE-2020-14593: Less Affine Transformations (JDK-8240119)\n - CVE-2020-14621: Better XML namespace handling (JDK-8242136)\n- Update tzdata requirement to 2022a to match JDK-8283350\n- Update NEWS from IcedTea\n- Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after\n  bump OpenJDK version","status":"published","published":"2022-08-22T13:07:36Z","modified":"2026-10-21T10:48:01.408185448Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1661176564","title":"Fixed 50 CVEs in java-1.7.0-openjdk","description":"- Bump to 2.6.28 and OpenJDK 7u351-b01.\n- Security fixes in 7u351:\n - CVE-2022-21540: Improve class compilation (JDK-8281859)\n - CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)\n - CVE-2022-34169: Improve Xalan supports (JDK-8285407)\n- Security fixes in 7u341:\n - CVE-2022-21426: Better XPath expression handling (JDK-8270504)\n - CVE-2022-21434: Better invocation handler handling (JDK-8277672)\n - CVE-2022-21443: Improved Object Identification (JDK-8275151)\n - CVE-2022-21476: Improve Santuario processing (JDK-8278008)\n - CVE-2022-21496: Improve URL supports (JDK-8278972)\n- Security fixes in 7u331:\n - CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)\n - CVE-2022-21282: Better resolution of URIs (JDK-8270492)\n - CVE-2022-21283: Better String matching (JDK-8268813)\n - CVE-2022-21293: Improve String constructions (JDK-8270392)\n - CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)\n - CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)\n - CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)\n - CVE-2022-21305: Better array indexing (JDK-8272014)\n - CVE-2022-21340: Verify Jar Verification (JDK-8272026)\n - CVE-2022-21341: Improve serial forms for transport (JDK-8272236)\n - CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)\n - CVE-2022-21360: Enhance BMP image support (JDK-8273756)\n - CVE-2022-21365: Enhanced BMP processing (JDK-8273838)\n- Security fixes in 7u321:\n - CVE-2021-35550: Update the default enabled cipher suites preference\n   (JDK-8163326)\n - CVE-2021-35556: Richer Text Editors (JDK-8265167)\n - CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)\n - CVE-2021-35561: Better hashing support (JDK-8266097)\n - CVE-2021-35564: Improve Keystore integrity (JDK-8266137)\n - CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close\n   (JDK-8254967)\n - CVE-2021-35586: Better BMP support (JDK-8267735)\n - CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if\n   InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)\n - CVE-2021-35603: Better session identification (JDK-8269618)\n- Security fixes in 7u311:\n - CVE-2021-2341: Improve file transfers (JDK-8258432)\n - CVE-2021-2369: Better jar file validation (JDK-8260967)\n - CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)\n- Security fixes in 7u301:\n - CVE-2021-2161: Less ambiguous processing (JDK-8250568)\n - CVE-2021-2163: Enhance opening JARs (JDK-8249906)\n- Security fixes in 7u281:\n - CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)\n - CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)\n - CVE-2020-14782: Enhance certificate processing (JDK-8237995)\n - CVE-2020-14792: Better range handling (JDK-8241114)\n - CVE-2020-14796: Improved URI Support (JDK-8242680)\n - CVE-2020-14797: Better Path Validation (JDK-8242685)\n - CVE-2020-14798: Enhanced buffer support (JDK-8242695)\n - CVE-2020-14803: Improved Buffer supports (JDK-8244136)\n- Security fixes in 7u271:\n - CVE-2020-14577: Enhance certificate verification (JDK-8237592)\n - CVE-2020-14578: NegativeArraySizeException in\n   sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)\n - CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)\n   (JDK-8028431)\n - CVE-2020-14581: Better matrix operations (JDK-8238002)\n - CVE-2020-14583: Better Buffer support (JDK-8238920)\n - CVE-2020-14593: Less Affine Transformations (JDK-8240119)\n - CVE-2020-14621: Better XML namespace handling (JDK-8242136)\n- Update tzdata requirement to 2022a to match JDK-8283350\n- Update NEWS from IcedTea\n- Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after\n  bump OpenJDK version","status":"published","published":"2022-08-22T13:56:04Z","modified":"2026-10-21T10:47:13.375639364Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"DLA-2917-1","title":"openjdk-8 - security update","status":"published","published":"2022-02-10T00:00:00Z","modified":"2026-03-09T01:22:45.655271Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2022:0873-1","title":"Security update for java-1_8_0-openjdk","description":"This update for java-1_8_0-openjdk fixes the following issues:\n\nUpdate to version jdk8u322 (icedtea-3.22.0)\n\nIncluding the following security fixes:\n\n- CVE-2022-21248, bsc#1194926: Enhance cross VM serialization\n- CVE-2022-21283, bsc#1194937: Better String matching\n- CVE-2022-21293, bsc#1194935: Improve String constructions\n- CVE-2022-21294, bsc#1194934: Enhance construction of Identity maps\n- CVE-2022-21282, bsc#1194933: Better resolution of URIs\n- CVE-2022-21296, bsc#1194932: Improve SAX Parser configuration management\n- CVE-2022-21299, bsc#1194931: Improved scanning of XML entities\n- CVE-2022-21305, bsc#1194939: Better array indexing\n- CVE-2022-21340, bsc#1194940: Verify Jar Verification\n- CVE-2022-21341, bsc#1194941: Improve serial forms for transport\n- CVE-2022-21349: Improve Solaris font rendering\n- CVE-2022-21360, bsc#1194929: Enhance BMP image support\n- CVE-2022-21365, bsc#1194928: Enhanced BMP processing\n","status":"published","published":"2022-03-16T09:36:16Z","modified":"2026-02-04T03:40:57.400008Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:1027-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate Java 8.0 to Service Refresh 7 Fix Pack 5 (bsc#1197126).\n\nIncluding fixes for the following vulnerabilities: \n\n  CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349,\n  CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,\n  CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294,\n  CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248,\n  CVE-2022-21271.\n\nNon-securtiy fix:\n\n- Fixed a broken symlink for javaws (bsc#1195146).\n","status":"published","published":"2022-03-29T13:42:03Z","modified":"2026-02-04T04:14:18.036083Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11895-1","title":"java-1_8_0-openjdk-1.8.0.322-1.1 on GA media","description":"These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.322-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:24.3448Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:0871-1","title":"Security update for java-1_8_0-openjdk","description":"This update for java-1_8_0-openjdk fixes the following issues:\n\nUpdate to version jdk8u322 (icedtea-3.22.0)\n\nIncluding the following security fixes:\n\n- CVE-2022-21248, bsc#1194926: Enhance cross VM serialization\n- CVE-2022-21283, bsc#1194937: Better String matching\n- CVE-2022-21293, bsc#1194935: Improve String constructions\n- CVE-2022-21294, bsc#1194934: Enhance construction of Identity maps\n- CVE-2022-21282, bsc#1194933: Better resolution of URIs\n- CVE-2022-21296, bsc#1194932: Improve SAX Parser configuration management\n- CVE-2022-21299, bsc#1194931: Improved scanning of XML entities\n- CVE-2022-21305, bsc#1194939: Better array indexing\n- CVE-2022-21340, bsc#1194940: Verify Jar Verification\n- CVE-2022-21341, bsc#1194941: Improve serial forms for transport\n- CVE-2022-21349: Improve Solaris font rendering\n- CVE-2022-21360, bsc#1194929: Enhance BMP image support\n- CVE-2022-21365, bsc#1194928: Enhanced BMP processing\n","status":"published","published":"2022-03-16T09:34:26Z","modified":"2026-02-04T04:27:18.283027Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0873-1","title":"Security update for java-1_8_0-openjdk","description":"This update for java-1_8_0-openjdk fixes the following issues:\n\nUpdate to version jdk8u322 (icedtea-3.22.0)\n\nIncluding the following security fixes:\n\n- CVE-2022-21248, bsc#1194926: Enhance cross VM serialization\n- CVE-2022-21283, bsc#1194937: Better String matching\n- CVE-2022-21293, bsc#1194935: Improve String constructions\n- CVE-2022-21294, bsc#1194934: Enhance construction of Identity maps\n- CVE-2022-21282, bsc#1194933: Better resolution of URIs\n- CVE-2022-21296, bsc#1194932: Improve SAX Parser configuration management\n- CVE-2022-21299, bsc#1194931: Improved scanning of XML entities\n- CVE-2022-21305, bsc#1194939: Better array indexing\n- CVE-2022-21340, bsc#1194940: Verify Jar Verification\n- CVE-2022-21341, bsc#1194941: Improve serial forms for transport\n- CVE-2022-21349: Improve Solaris font rendering\n- CVE-2022-21360, bsc#1194929: Enhance BMP image support\n- CVE-2022-21365, bsc#1194928: Enhanced BMP processing\n","status":"published","published":"2022-03-16T09:37:15Z","modified":"2026-02-04T02:49:05.217144Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1025-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\nUpdate Java 7.1 to Service Refresh 7 Fix Pack 5 (bsc#1197126).\n\nIncluding fixes for the following vulnerabilities: \n\n  CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349,\n  CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,\n  CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294,\n  CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248,\n  CVE-2022-21271.\n","status":"published","published":"2022-03-29T13:37:45Z","modified":"2026-02-04T03:05:43.220579Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1026-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate Java 8.0 to Service Refresh 7 Fix Pack 5 (bsc#1197126).\n\nIncluding fixes for the following vulnerabilities: \n\n  CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349,\n  CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,\n  CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294,\n  CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248,\n  CVE-2022-21271.\n\nNon-securtiy fix:\n\n- Fixed a broken symlink for javaws (bsc#1195146).\n","status":"published","published":"2022-03-29T13:39:25Z","modified":"2026-02-04T03:02:07.294025Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1027-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate Java 8.0 to Service Refresh 7 Fix Pack 5 (bsc#1197126).\n\nIncluding fixes for the following vulnerabilities: \n\n  CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349,\n  CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,\n  CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294,\n  CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248,\n  CVE-2022-21271.\n\nNon-securtiy fix:\n\n- Fixed a broken symlink for javaws (bsc#1195146).\n","status":"published","published":"2022-03-29T13:42:48Z","modified":"2026-02-04T04:13:43.120961Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14926-1","title":"Security update for java-1_7_0-ibm","description":"This update for java-1_7_0-ibm fixes the following issues:\n\nUpdate Java 7.0 to Service Refresh 11 Fix Pack 5 (bsc#1197126).\n\nIncluding fixes for the following vulnerabilities: \n\n  CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349,\n  CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,\n  CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294,\n  CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248,\n  CVE-2022-21271.\n","status":"published","published":"2022-03-23T08:10:48Z","modified":"2026-02-04T03:30:51.258746Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:14927-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\nUpdate Java 7.1 to Service Refresh 7 Fix Pack 5 (bsc#1197126).\n\nIncluding fixes for the following vulnerabilities: \n\n  CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349,\n  CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,\n  CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294,\n  CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248,\n  CVE-2022-21271.\n","status":"published","published":"2022-03-23T09:42:03Z","modified":"2026-02-04T03:00:24.648829Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}