{"id":"CVE-2022-40609","aliases":["EUVD-2022-43883","GHSA-2cf4-9q4p-f6wj","RHSA-2023:4103","RHSA-2023:4160","SUSE-SU-2023:3406-1","SUSE-SU-2023:3441-1"],"status":"published","title":"IBM SDK, Java Technology Edition code execution","description":"IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  236069.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01761,"percentile":0.78165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2023-08-02T14:21:51Z","modified":"2026-10-09T10:06:40Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-webstart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1.el8_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1jpp.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1jpp.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1jpp.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1jpp.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1jpp.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.5-1jpp.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-30.114.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-30.114.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-30.114.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.10-150000.3.80.1"}]}],"bundled":8}],"products":[{"vendor":"ibm","product":"sdk"},{"vendor":"ibm","product":"sdk, java technology edition"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7017032","tags":["vendor-advisory","x_transferred","Vendor Advisory","article"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/236069","tags":["vdb-entry","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40609","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2cf4-9q4p-f6wj"},{"url":"https://access.redhat.com/errata/RHSA-2023:4103","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187758","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187802","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4103.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40609","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-21930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-21930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-21937","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-21937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21937","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-21938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-21938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21938","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-21939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-21939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-21967","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-21967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21967","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-21968","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-21968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21968","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4160","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4160.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233406-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214431","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25193","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233441-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207922","tags":["report"]},{"url":"https://bugzilla.suse.com/1213473","tags":["report"]},{"url":"https://bugzilla.suse.com/1213474","tags":["report"]},{"url":"https://bugzilla.suse.com/1213475","tags":["report"]},{"url":"https://bugzilla.suse.com/1213479","tags":["report"]},{"url":"https://bugzilla.suse.com/1213481","tags":["report"]},{"url":"https://bugzilla.suse.com/1213482","tags":["report"]},{"url":"https://bugzilla.suse.com/1213541","tags":["report"]},{"url":"https://bugzilla.suse.com/1213934","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-40609","title":"IBM SDK, Java Technology Edition code execution","description":"IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  236069.","status":"published","published":"2023-08-02T14:21:51.701Z","modified":"2024-10-17T18:51:39.988Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-43883","description":"IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  236069.","status":"published","published":"2023-08-02T14:21:51Z","modified":"2024-10-17T18:51:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:33.264541Z"}],"ghsa":[{"id":"GHSA-2cf4-9q4p-f6wj","title":"IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute...","description":"IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  236069.","status":"published","published":"2023-08-02T15:30:54Z","modified":"2024-04-04T06:29:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:56:42.669106Z"}],"nvd":[{"id":"CVE-2022-40609","description":"IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  236069.","status":"published","published":"2023-08-02T15:15:09.833Z","modified":"2026-06-17T05:01:42.64Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:38.721429Z"}],"osv":[{"id":"RHSA-2023:4103","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T21:14:16Z","modified":"2026-10-09T10:06:37Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4160","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T21:15:17Z","modified":"2026-10-09T10:06:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"SUSE-SU-2023:3406-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541)\n- CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute arbitrary code on the system. (bsc#1213934)\n- CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access. (bsc#1213475)\n- CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482)\n- CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481)\n- CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479)\n- CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of service. (bsc#1213474)\n- CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. (bsc#1207922)\n- CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK accessible data. (bsc#1213473)\n","status":"published","published":"2023-08-23T17:20:36Z","modified":"2026-02-04T03:51:18.986062Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3441-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541)\n- CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute arbitrary code on the system. (bsc#1213934)\n- CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access. (bsc#1213475)\n- CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482)\n- CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481)\n- CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479)\n- CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of service. (bsc#1213474)\n- CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. (bsc#1207922)\n- CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK accessible data. (bsc#1213473)\n","status":"published","published":"2023-08-28T07:55:06Z","modified":"2026-02-04T02:24:17.246028Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}