{"id":"CVE-2022-21449","aliases":["ALPINE-CVE-2022-21449","ALSA-2022:1445","BIT-java-2022-21449","BIT-java-min-2022-21449","BIT-jre-2022-21449","DEBIAN-CVE-2022-21449","DSA-5128-1","EUVD-2022-26673","GHSA-cj8x-r9fp-q656","OESA-2022-1702","RHSA-2022:1445","RHSA-2022:1729","RLSA-2022:1445","SUSE-SU-2022:2539-1","SUSE-SU-2022:2540-1","SUSE-SU-2022:2650-1","UBUNTU-CVE-2022-21449","USN-5388-2","USN-5546-1","openSUSE-SU-2024:12014-1","openSUSE-SU-2024:12015-1","openSUSE-SU-2024:12019-1"],"status":"published","title":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.77151,"percentile":0.99559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2022-04-19T20:37:39Z","modified":"2026-11-03T08:02:52Z","exploits":[{"source":"pocgithub","id":"jfrog/jfrog-CVE-2022-21449","title":"jfrog/jfrog-CVE-2022-21449","date":"2022-04-20","url":"https://github.com/jfrog/jfrog-CVE-2022-21449"},{"source":"pocgithub","id":"jmiettinen/CVE-2022-21449-vuln-test","title":"jmiettinen/CVE-2022-21449-vuln-test","date":"2022-04-20","url":"https://github.com/jmiettinen/CVE-2022-21449-vuln-test"},{"source":"pocgithub","id":"notkmhn/CVE-2022-21449-TLS-PoC","title":"notkmhn/CVE-2022-21449-TLS-PoC","date":"2022-04-20","url":"https://github.com/notkmhn/CVE-2022-21449-TLS-PoC"},{"source":"pocgithub","id":"marschall/psychic-signatures","title":"marschall/psychic-signatures","date":"2022-04-21","url":"https://github.com/marschall/psychic-signatures"},{"source":"pocgithub","id":"thack1/CVE-2022-21449","title":"thack1/CVE-2022-21449","date":"2022-04-24","url":"https://github.com/thack1/CVE-2022-21449"},{"source":"pocgithub","id":"Damok82/SignChecker","title":"Damok82/SignChecker","date":"2022-04-25","url":"https://github.com/Damok82/SignChecker"},{"source":"pocgithub","id":"fundaergn/CVE-2022-21449","title":"fundaergn/CVE-2022-21449","date":"2022-06-12","url":"https://github.com/fundaergn/CVE-2022-21449"},{"source":"pocgithub","id":"Skipper7718/CVE-2022-21449-showcase","title":"Skipper7718/CVE-2022-21449-showcase","date":"2022-07-29","url":"https://github.com/Skipper7718/CVE-2022-21449-showcase"},{"source":"pocgithub","id":"davwwwx/CVE-2022-21449","title":"davwwwx/CVE-2022-21449","date":"2022-08-30","url":"https://github.com/davwwwx/CVE-2022-21449"},{"source":"pocgithub","id":"AlexanderZinoni/CVE-2022-21449","title":"AlexanderZinoni/CVE-2022-21449","date":"2022-09-04","url":"https://github.com/AlexanderZinoni/CVE-2022-21449"},{"source":"pocgithub","id":"HeyMrSalt/AIS3-2024-Project-D5Team","title":"HeyMrSalt/AIS3-2024-Project-D5Team","date":"2024-08-01","url":"https://github.com/HeyMrSalt/AIS3-2024-Project-D5Team"},{"source":"pocgithub","id":"volodymyr-hladkyi-symphony/demo-cve-2022-21449","title":"volodymyr-hladkyi-symphony/demo-cve-2022-21449","date":"2025-05-21","url":"https://github.com/volodymyr-hladkyi-symphony/demo-cve-2022-21449"},{"source":"pocgithub","id":"fevra-dev/ClaimJumper","title":"fevra-dev/ClaimJumper","date":"2026-01-16","url":"https://github.com/fevra-dev/ClaimJumper"}],"fixes":[{"ecosystem":"Alpine:v3.15","package":"openjdk15","fixed_in":["15.0.7_p4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openjdk15","fixed_in":["15.0.7_p4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openjdk15","fixed_in":["15.0.7_p4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openjdk15","fixed_in":["15.0.7_p4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openjdk17","fixed_in":["17.0.3_p7-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java","fixed_in":["17.0.3","18.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java-min","fixed_in":["17.0.3","18.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jre","fixed_in":["17.0.3","18.0.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openjdk-17","fixed_in":["17.0.3+7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-17","fixed_in":["17.0.3+7-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-17","fixed_in":["17.0.3+7-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-17","fixed_in":["17.0.3+7-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-18","fixed_in":["18.0.2+9-2~22.04"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"openjdk15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.7_p4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openjdk15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.7_p4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openjdk15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.7_p4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openjdk15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.7_p4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3_p7-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-demo-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-demo-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-devel-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-devel-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-headless-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-headless-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-jmods-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-jmods-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-src-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-src-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-static-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-static-libs-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"java-17-openjdk-static-libs-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Bitnami","package":"java","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"17.0.3"},{"introduced":"18.0.0"},{"fixed":"18.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java-min","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"17.0.3"},{"introduced":"18.0.0"},{"fixed":"18.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jre","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"17.0.3"},{"introduced":"18.0.0"},{"fixed":"18.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-1~deb11u1"}]}],"versions":["17+35-1","17.0.1+12-1","17.0.1+12-1+deb11u1","17.0.1+12-1+deb11u2","17.0.2+8-1","17.0.2+8-1~deb11u1","17~19-1","17~24-1","17~27-1","17~29-1","17~31ea-1","17~33ea-1","17~35ea-1"],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"openjdk-latest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-latest-openjdk-18.0.1.10-0.rolling.oe1"}]}],"bundled":31},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"openjdk-latest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-latest-openjdk-18.0.1.10-0.rolling.oe1"}]}],"bundled":31},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"openjdk-latest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-latest-openjdk-18.0.1.10-0.rolling.oe2203"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-17-openjdk-static-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-demo-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-demo-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-devel-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-devel-fastdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-devel-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-devel-slowdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-fastdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-headless-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-headless-fastdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-headless-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-headless-slowdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-jmods-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-jmods-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-slowdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-src-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-src-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-static-libs-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-17-openjdk-static-libs-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"java-17-openjdk-static-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-demo-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-demo-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-devel-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-devel-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-headless-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-headless-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-jmods-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-jmods-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-src-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-src-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-static-libs-fastdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"java-17-openjdk-static-libs-slowdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.7-1.el9_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"java-17-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.3.0.6-2.el8_5"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.10-38.71.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-30.90.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.10-150000.3.59.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-0ubuntu0.18.04.1"}]}],"versions":["17+35-1~18.04","17.0.1+12-1~18.04","17.0.2+8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-0ubuntu0.20.04.1"}]}],"versions":["17+35-1~20.04","17.0.1+12-1~20.04","17.0.2+8-1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.0.1+9-1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-0ubuntu0.22.04.1"}]}],"versions":["17+35-1","17.0.1+12-1","17.0.2+8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.0.2+9-2~22.04"}]}],"versions":["18~15ea-4","18~20ea-1","18~32ea-1","18~36ea-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-0ubuntu0.18.04.1"}]}],"versions":["17+35-1~18.04","17.0.1+12-1~18.04","17.0.2+8-1~18.04"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-0ubuntu0.20.04.1"}]}],"versions":["17+35-1~20.04","17.0.1+12-1~20.04","17.0.2+8-1~20.04"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3+7-0ubuntu0.22.04.1"}]}],"versions":["17+35-1","17.0.1+12-1","17.0.2+8-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.4+8-1~18.04"}]}],"versions":["17+35-1~18.04","17.0.1+12-1~18.04","17.0.2+8-1~18.04","17.0.3+7-0ubuntu0.18.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u342-b07-0ubuntu1~18.04"}]}],"versions":["8u144-b01-2","8u151-b12-1","8u162-b12-1","8u171-b11-0ubuntu0.18.04.1","8u181-b13-0ubuntu0.18.04.1","8u181-b13-1ubuntu0.18.04.1","8u191-b12-0ubuntu0.18.04.1","8u191-b12-2ubuntu0.18.04.1","8u212-b03-0ubuntu1.18.04.1","8u222-b10-1ubuntu1~18.04.1","8u232-b09-0ubuntu1~18.04.1","8u242-b08-0ubuntu3~18.04","8u252-b09-1~18.04","8u265-b01-0ubuntu2~18.04","8u272-b10-0ubuntu1~18.04","8u275-b01-0ubuntu1~18.04","8u282-b08-0ubuntu1~18.04","8u292-b10-0ubuntu1~18.04","8u312-b07-0ubuntu1~18.04"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.16+8-0ubuntu1~18.04"}]}],"versions":["9.0.4+12-2ubuntu4","9.0.4+12-4ubuntu1","10~46-4ubuntu1","10~46-5ubuntu1","10.0.1+10-1ubuntu2","10.0.1+10-3ubuntu1","10.0.2+13-1ubuntu0.18.04.1","10.0.2+13-1ubuntu0.18.04.2","10.0.2+13-1ubuntu0.18.04.3","10.0.2+13-1ubuntu0.18.04.4","11.0.2+9-3ubuntu1~18.04.3","11.0.3+7-1ubuntu2~18.04.1","11.0.4+11-1ubuntu2~18.04.3","11.0.5+10-0ubuntu1.1~18.04","11.0.6+10-1ubuntu1~18.04.1","11.0.7+10-2ubuntu2~18.04","11.0.8+10-0ubuntu1~18.04.1","11.0.9+11-0ubuntu1~18.04.1","11.0.9.1+1-0ubuntu1~18.04","11.0.10+9-0ubuntu1~18.04","11.0.11+9-0ubuntu2~18.04","11.0.13+8-0ubuntu1~18.04","11.0.14+9-0ubuntu2~18.04","11.0.14.1+1-0ubuntu1~18.04","11.0.15+10-0ubuntu0.18.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.4+8-1~20.04"}]}],"versions":["17+35-1~20.04","17.0.1+12-1~20.04","17.0.2+8-1~20.04","17.0.3+7-0ubuntu0.20.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u342-b07-0ubuntu1~20.04"}]}],"versions":["8u232-b09-0ubuntu1","8u232-b09-1","8u242-b04-1","8u242-b08-0ubuntu3","8u252-b07-1","8u252-b09-1ubuntu1","8u265-b01-0ubuntu2~20.04","8u272-b10-0ubuntu1~20.04","8u275-b01-0ubuntu1~20.04","8u282-b08-0ubuntu1~20.04","8u292-b10-0ubuntu1~20.04","8u312-b07-0ubuntu1~20.04"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.16+8-0ubuntu1~20.04"}]}],"versions":["11.0.5+10-0ubuntu1","11.0.5+10-2ubuntu1","11.0.6+10-1ubuntu1","11.0.6+10-2ubuntu2","11.0.7+9-1ubuntu1","11.0.7+10-2ubuntu1","11.0.7+10-3ubuntu1","11.0.8+10-0ubuntu1~20.04","11.0.9+11-0ubuntu1~20.04","11.0.9.1+1-0ubuntu1~20.04","11.0.10+9-0ubuntu1~20.04","11.0.11+9-0ubuntu2~20.04","11.0.13+8-0ubuntu1~20.04","11.0.14+9-0ubuntu2~20.04","11.0.14.1+1-0ubuntu1~20.04","11.0.15+10-0ubuntu0.20.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.4+8-1~22.04"}]}],"versions":["17+35-1","17.0.1+12-1","17.0.2+8-1","17.0.3+7-0ubuntu0.22.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.0.2+9-2~22.04"}]}],"versions":["18~15ea-4","18~20ea-1","18~32ea-1","18~36ea-1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u342-b07-0ubuntu1~22.04"}]}],"versions":["8u302-b08-0ubuntu2","8u312-b07-0ubuntu1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.16+8-0ubuntu1~22.04"}]}],"versions":["11.0.12+7-0ubuntu3","11.0.13+8-0ubuntu1","11.0.14+9-0ubuntu2","11.0.14.1+1-0ubuntu1","11.0.15+10-0ubuntu0.22.04.1"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-15-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.7.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-18-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.0.1.0-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-17-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.3.0-1.1"}]}],"bundled":6}],"products":[{"vendor":"azul","product":"zulu"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"7-mode_transition_tool"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"cloud_insights"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"e-series_santricity_storage_manager"},{"vendor":"netapp","product":"e-series_santricity_web_services"},{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"santricity_unified_manager"},{"vendor":"netapp","product":"solidfire\\,_enterprise_sds_\\\u0026_hci_storage_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"oracle","product":"graalvm"},{"vendor":"oracle","product":"jdk"},{"vendor":"oracle corporation","product":"java se jdk and jre"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/28/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/28/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/28/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","discussion","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/28/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/28/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/28/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://security.netapp.com/advisory/ntap-20220429-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/29/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/30/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/30/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/30/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/30/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/01/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/02/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://www.debian.org/security/2022/dsa-5128","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5131","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21449","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cj8x-r9fp-q656"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-21449","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1445.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2022-21426","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-21434","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-21443","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-21449","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-21476","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-21496","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21449.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21449","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21476","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21443","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35561","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21299","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-2163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-2161","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1445","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075849","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1445.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21426","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21434","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21443","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21443","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21449","tags":["advisory","report"]},{"url":"https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21476","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21496","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1729","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1729.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1445","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222539-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191912","tags":["report"]},{"url":"https://bugzilla.suse.com/1194931","tags":["report"]},{"url":"https://bugzilla.suse.com/1198670","tags":["report"]},{"url":"https://bugzilla.suse.com/1198671","tags":["report"]},{"url":"https://bugzilla.suse.com/1198672","tags":["report"]},{"url":"https://bugzilla.suse.com/1198673","tags":["report"]},{"url":"https://bugzilla.suse.com/1198674","tags":["report"]},{"url":"https://bugzilla.suse.com/1198675","tags":["report"]},{"url":"https://bugzilla.suse.com/1201643","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21496","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222540-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222650-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21449","tags":["report"]},{"url":"https://github.com/openjdk/jdk17u/commit/2d4103a3d929e05edca98e7703e0869077966be7","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5388-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5546-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34169","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-19T20:37:39Z","modified":"2024-09-24T20:10:30.389Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-26673","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-19T20:37:39Z","modified":"2024-09-24T20:10:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:14.002106Z"}],"ghsa":[{"id":"GHSA-cj8x-r9fp-q656","title":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-20T00:00:25Z","modified":"2023-01-27T05:01:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:41:58.364763Z"}],"nvd":[{"id":"CVE-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-19T21:15:16.127Z","modified":"2026-06-17T04:26:17.33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"ALPINE-CVE-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-19T21:15:16.127Z","modified":"2026-11-03T07:30:25.672289546Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-19T20:37:39Z","modified":"2026-10-28T02:31:04.027553141Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-19T21:15:16.127Z","modified":"2026-11-03T08:02:52.174432117Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"OESA-2022-1702","title":"openjdk-latest security update","description":"The OpenJDK runtime environment.\n\nSecurity Fix(es):\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2022-21449)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2022-21476)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21443)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21426)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21496)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21434)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).(CVE-2021-35567)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2021-35586)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2021-35559)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2021-35564)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2021-35603)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2021-35561)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2021-35578)\n\nVulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2021-35556)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21299)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21365)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21341)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21366)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21360)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21340)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21305)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2022-21296)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21294)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21293)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21291)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21283)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2022-21282)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21277)\n\nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21248)\n\nVulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).(CVE-2021-2163)\n\nVulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2021-2161)","status":"published","published":"2022-06-10T11:04:58Z","modified":"2026-08-18T01:16:47.575992954Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:1445","title":"Red Hat Security Advisory: java-17-openjdk security and bug fix update","status":"published","published":"2024-09-16T07:52:21Z","modified":"2026-10-09T10:03:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1729","title":"Red Hat Security Advisory: java-17-openjdk security update","status":"published","published":"2024-09-16T07:53:32Z","modified":"2026-10-09T10:04:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1445","title":"Important: java-17-openjdk security and bug fix update","description":"The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.\n\nSecurity Fix(es):\n\n* OpenJDK: Improper ECDSA signature verification (Libraries, 8277233) (CVE-2022-21449)\n\n* OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476)\n\n* OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) (CVE-2022-21426)\n\n* OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672) (CVE-2022-21434)\n\n* OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443)\n\n* OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Enable the import of plain keys into the NSS Software Token while in FIPS mode [Rocky Linux-8, openjdk-17] (BZ#2018189)\n\n* Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode [Rocky Linux-8, openjdk-17] (BZ#2055396)","status":"published","published":"2022-04-20T12:21:21Z","modified":"2026-02-05T00:30:14.806578Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2022-04-19T21:15:00Z","modified":"2026-02-04T02:57:27.57843Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"ALSA-2022:1445","title":"Important: java-17-openjdk security and bug fix update","description":"The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.\n\nSecurity Fix(es):\n\n* OpenJDK: Improper ECDSA signature verification (Libraries, 8277233) (CVE-2022-21449)\n\n* OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476)\n\n* OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) (CVE-2022-21426)\n\n* OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672) (CVE-2022-21434)\n\n* OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443)\n\n* OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Enable the import of plain keys into the NSS Software Token while in FIPS mode [almalinux-8, openjdk-17] (BZ#2018189)\n\n* Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode [almalinux-8, openjdk-17] (BZ#2055396)","status":"published","published":"2022-04-20T12:21:21Z","modified":"2026-10-29T11:02:01.858289728Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-java-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2026-05-06T14:43:14.106Z","modified":"2026-09-08T08:48:12.445969292Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-java-min-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2026-05-06T14:43:16.452Z","modified":"2026-09-08T08:47:55.355945998Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-jre-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","status":"published","published":"2026-05-08T05:44:44.33Z","modified":"2026-09-08T08:48:04.994113765Z","updated_at":"2026-11-02T15:28:31.782692Z"},{"id":"DSA-5128-1","title":"openjdk-17 - security update","status":"published","published":"2022-05-03T00:00:00Z","modified":"2026-03-09T02:10:14.373304Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2024:12014-1","title":"java-15-openjdk-15.0.7.0-1.1 on GA media","description":"These are all security issues fixed in the java-15-openjdk-15.0.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:31:46.804155Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12015-1","title":"java-18-openjdk-18.0.1.0-1.1 on GA media","description":"These are all security issues fixed in the java-18-openjdk-18.0.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:40.728791Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12019-1","title":"java-17-openjdk-17.0.3.0-1.1 on GA media","description":"These are all security issues fixed in the java-17-openjdk-17.0.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:10:35.272765Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2539-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\nUpdate to Java 7.1 Service Refresh 5 Fix Pack 10 (bsc#1201643), including fixes for:\n  \n- CVE-2022-21476 (bsc#1198671), CVE-2022-21449 (bsc#1198670),\n  CVE-2022-21496 (bsc#1198673), CVE-2022-21434 (bsc#1198674),\n  CVE-2022-21426 (bsc#1198672), CVE-2022-21443 (bsc#1198675),\n  CVE-2021-35561 (bsc#1191912), CVE-2022-21299 (bsc#1194931).\n","status":"published","published":"2022-07-23T10:29:07Z","modified":"2026-02-04T03:37:32.508887Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2540-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 7 Fix Pack 10 (bsc#1201643), including fixes for:\n\n- CVE-2022-21476 (bsc#1198671), CVE-2022-21449 (bsc#1198670),\n  CVE-2022-21496 (bsc#1198673), CVE-2022-21434 (bsc#1198674),\n  CVE-2022-21426 (bsc#1198672), CVE-2022-21443 (bsc#1198675),\n  CVE-2021-35561 (bsc#1191912), CVE-2022-21299 (bsc#1194931).\n","status":"published","published":"2022-07-23T10:30:43Z","modified":"2026-02-04T03:48:55.215432Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2650-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]\n\n- CVE-2022-21476 (bsc#1198671), CVE-2022-21449 (bsc#1198670),\n  CVE-2022-21496 (bsc#1198673), CVE-2022-21434 (bsc#1198674),\n  CVE-2022-21426 (bsc#1198672), CVE-2022-21443 (bsc#1198675),\n  CVE-2021-35561 (bsc#1191912), CVE-2022-21299 (bsc#1194931).\n","status":"published","published":"2022-08-03T13:09:46Z","modified":"2026-02-04T02:25:08.002758Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5388-2","title":"openjdk-17 vulnerabilities","description":"It was discovered that OpenJDK incorrectly verified ECDSA signatures. An\nattacker could use this issue to bypass the signature verification process.\n(CVE-2022-21449)\n\nIt was discovered that OpenJDK incorrectly limited memory when compiling a\nspecially crafted XPath expression. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2022-21426)\n\nIt was discovered that OpenJDK incorrectly handled converting certain\nobject arguments into their textual representations. An attacker could\npossibly use this issue to cause a denial of service. (CVE-2022-21434)\n\nIt was discovered that OpenJDK incorrectly validated the encoded length of\ncertain object identifiers. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2022-21443)\n\nIt was discovered that OpenJDK incorrectly validated certain paths. An\nattacker could possibly use this issue to bypass the secure validation\nfeature and expose sensitive information in XML files. (CVE-2022-21476)\n\nIt was discovered that OpenJDK incorrectly parsed certain URI strings. An\nattacker could possibly use this issue to make applications accept\ninvalid of malformed URI strings. (CVE-2022-21496)\n","status":"published","published":"2022-04-26T11:57:36Z","modified":"2026-04-27T19:32:12.052403972Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5546-1","title":"openjdk-8, openjdk-lts, openjdk-17, openjdk-18 vulnerabilities","description":"Neil Madden discovered that OpenJDK did not properly verify ECDSA\nsignatures. A remote attacker could possibly use this issue to insert,\nedit or obtain sensitive information. This issue only affected OpenJDK\n17 and OpenJDK 18. (CVE-2022-21449)\n\nIt was discovered that OpenJDK incorrectly limited memory when compiling a\nspecially crafted XPath expression. An attacker could possibly use this\nissue to cause a denial of service. This issue was fixed in OpenJDK 8 and\nOpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11\nand OpenJDK 17. (CVE-2022-21426)\n\nIt was discovered that OpenJDK incorrectly handled converting certain\nobject arguments into their textual representations. An attacker could\npossibly use this issue to cause a denial of service. This issue was\nfixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed\nthis issue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21434)\n\nIt was discovered that OpenJDK incorrectly validated the encoded length of\ncertain object identifiers. An attacker could possibly use this issue to\ncause a denial of service. This issue was fixed in OpenJDK 8 and OpenJDK 18.\nUSN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11 and OpenJDK 17.\n(CVE-2022-21443)\n\nIt was discovered that OpenJDK incorrectly validated certain paths. An\nattacker could possibly use this issue to bypass the secure validation\nfeature and expose sensitive information in XML files. This issue was\nfixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this\nissue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21476)\n\nIt was discovered that OpenJDK incorrectly parsed certain URI strings. An\nattacker could possibly use this issue to make applications accept\ninvalid of malformed URI strings. This issue was fixed in OpenJDK 8 and\nOpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11\nand OpenJDK 17. (CVE-2022-21496)\n\nIt was discovered that OpenJDK incorrectly generated class code in the\nHotspot component. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-21540)\n\nIt was dicovered that OpenJDK incorrectly restricted access to the\ninvokeBasic() method in the Hotspot component. An attacker could possibly\nuse this issue to insert, edit or obtain sensitive information.\n(CVE-2022-21541)\n\nIt was discovered that OpenJDK incorrectly computed exponentials. An\nattacker could possibly use this issue to insert, edit or obtain sensitive\ninformation. This issue only affected OpenJDK 17.\n(CVE-2022-21549)\n\nIt was discovered that OpenJDK includes a copy of Xalan that incorrectly\nhandled integer truncation. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2022-34169)\n","status":"published","published":"2022-08-04T15:24:27Z","modified":"2026-05-29T18:00:44.301130985Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}