{"id":"CVE-2023-30441","aliases":["EUVD-2023-34859","GHSA-2v8w-cv2x-fj9v","RHSA-2022:6735","RHSA-2022:6756","SUSE-SU-2023:2476-1","SUSE-SU-2023:2491-1"],"status":"published","title":"IBM Java information disclosure","description":"IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations.  IBM X-Force ID:  253188.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00604,"percentile":0.49196,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-327"],"published":"2023-04-29T14:40:40Z","modified":"2026-06-29T10:43:16Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-webstart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1jpp.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1jpp.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1jpp.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1jpp.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1jpp.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.15-1jpp.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-30.108.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.5-150000.3.74.1"}]}],"bundled":9}],"products":[{"vendor":"ibm","product":"infosphere_information_server"},{"vendor":"ibm","product":"java"},{"vendor":"ibm","product":"websphere_application_server"},{"vendor":"ibm","product":"z\\/transaction_processing_facility"},{"vendor":"oracle corporation","product":"java"}],"references":[{"url":"https://www.ibm.com/support/pages/node/6985011","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/6987167","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/6986637","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/6986617","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/253188","tags":["vdb-entry","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30441","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2v8w-cv2x-fj9v"},{"url":"https://access.redhat.com/errata/RHSA-2022:6735","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951217","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6735.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-2163","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-2163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-2163","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30441","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6756","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6756.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232476-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210628","tags":["report"]},{"url":"https://bugzilla.suse.com/1210631","tags":["report"]},{"url":"https://bugzilla.suse.com/1210632","tags":["report"]},{"url":"https://bugzilla.suse.com/1210634","tags":["report"]},{"url":"https://bugzilla.suse.com/1210635","tags":["report"]},{"url":"https://bugzilla.suse.com/1210636","tags":["report"]},{"url":"https://bugzilla.suse.com/1210637","tags":["report"]},{"url":"https://bugzilla.suse.com/1210711","tags":["report"]},{"url":"https://bugzilla.suse.com/1210826","tags":["report"]},{"url":"https://bugzilla.suse.com/1211615","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-21930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-21937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-21938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-21939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-21954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-21967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-21968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30441","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232491-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-30441","title":"IBM Java information disclosure","description":"IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations.  IBM X-Force ID:  253188.","status":"published","published":"2023-04-29T14:40:40.263Z","modified":"2025-01-30T17:01:26.113Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-34859","description":"IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations.  IBM X-Force ID:  253188.","status":"published","published":"2023-04-29T14:40:40Z","modified":"2025-01-30T17:01:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:09.009549Z"}],"ghsa":[{"id":"GHSA-2v8w-cv2x-fj9v","title":"IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11...","description":"IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations.  IBM X-Force ID:  253188.","status":"published","published":"2023-04-29T15:30:18Z","modified":"2024-04-04T03:44:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:56:18.00765Z"}],"nvd":[{"id":"CVE-2023-30441","description":"IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations.  IBM X-Force ID:  253188.","status":"published","published":"2023-04-29T15:15:18.953Z","modified":"2026-06-17T05:54:42.38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:07:59.151142Z"}],"osv":[{"id":"RHSA-2022:6735","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T22:49:36Z","modified":"2026-06-29T10:43:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6756","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T22:49:20Z","modified":"2026-06-29T10:43:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"SUSE-SU-2023:2476-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- CVE-2023-21930: Fixed possible compromise from unauthenticated attacker with network access via TLS (bsc#1210628).\n- CVE-2023-21937: Fixed vulnerability inside the networking component (bsc#1210631).\n- CVE-2023-21938: Fixed vulnerability inside the library component (bsc#1210632).\n- CVE-2023-21939: Fixed vulnerability inside the swing component (bsc#1210634).\n- CVE-2023-21968: Fixed vulnerability inside the library component (bsc#1210637).\n- CVE-2023-2597: Fixed buffer overflow in shared cache implementation (bsc#1211615).\n- CVE-2023-21967: Fixed vulnerability inside the JSSE component (bsc#1210636).\n- CVE-2023-21954: Fixed vulnerability inside the hotspot component (bsc#1210635).\n\nAdditional reference fixed already in 8.0.7.15:\n\n- CVE-2023-30441: Fixed components that could have exposed sensitive information using a combination of flaws and configurations (bsc#1210711).\n","status":"published","published":"2023-06-09T05:34:25Z","modified":"2026-02-04T03:29:35.417416Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2491-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- CVE-2023-21930: Fixed possible compromise from unauthenticated attacker with network access via TLS (bsc#1210628).\n- CVE-2023-21937: Fixed vulnerability inside the networking component (bsc#1210631).\n- CVE-2023-21938: Fixed vulnerability inside the library component (bsc#1210632).\n- CVE-2023-21939: Fixed vulnerability inside the swing component (bsc#1210634).\n- CVE-2023-21968: Fixed vulnerability inside the library component (bsc#1210637).\n- CVE-2023-2597: Fixed buffer overflow in shared cache implementation (bsc#1211615).\n- CVE-2023-21967: Fixed vulnerability inside the JSSE component (bsc#1210636).\n- CVE-2023-21954: Fixed vulnerability inside the hotspot component (bsc#1210635).\n\nAdditional reference fixed already in 8.0.7.15:\n\n- CVE-2023-30441: Fixed components that could have exposed sensitive information using a combination of flaws and configurations (bsc#1210711).\n","status":"published","published":"2023-06-13T06:02:05Z","modified":"2026-02-04T03:37:30.534951Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}