CVE-2022-21305

medium

Published 2022-01-19 · Modified 2022-01-27

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.3

Description

RHSA-2022:0307: java-1.8.0-openjdk security and bug fix update (Moderate)

Predictions

Exploit likelihood

63%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

OS	Version	Status	Fixed in
sles		affected
rocky	8	fixed
debian	bullseye	fixed	`11.0.14+9-1~deb11u1`
debian	sid	fixed	`11.0.14+9-1`
debian	bookworm	fixed	`17.0.2+8-1`
debian	9.0	affected
debian	10.0	affected
debian	11.0	affected
rhel	8	fixed

Application impact

Vendor	Product	Versions	Fixed
oracle	graalvm	`21.3.0`
oracle	jdk	`1.7.0`
oracle	jdk	`1.8.0`
oracle	graalvm	`20.3.4`
oracle	graalvm	`21.3.0`
oracle	jdk	`1.7.0`
oracle	jdk	`1.8.0`
oracle	jdk	`11.0.13`
oracle	jdk	`17.0.1`
oracle	jre	`1.7.0`
oracle	jre	`1.8.0`
oracle	jre	`11.0.13`
oracle	jre	`17.0.1`
netapp	7-mode_transition_tool	`-`
netapp	active_iq_unified_manager	`-`
netapp	cloud_insights_acquisition_unit	`-`
netapp	cloud_secure_agent	`-`
netapp	e-series_santricity_os_controller	`{"startIncluding":"11.0.0","endIncluding":"11.70.1"}`
netapp	e-series_santricity_storage_manager	`-`
netapp	e-series_santricity_web_services	`-`
netapp	hci_management_node	`-`
netapp	oncommand_insight	`-`
netapp	oncommand_workflow_automation	`-`
netapp	santricity_storage_plugin	`-`
netapp	santricity_unified_manager	`-`
netapp	snapmanager	`-`
netapp	solidfire	`-`
oracle	openjdk	`{"startIncluding":"11","endIncluding":"11.0.13"}`
oracle	openjdk	`7`
oracle	openjdk	`8`
oracle	openjdk	`17`
oracle	openjdk	`17.0.1`
oracle	jdk	`11.0.13`
oracle	jdk	`17.0.1`
oracle	jre	`1.7.0`
oracle	jre	`1.8.0`
oracle	jre	`11.0.13`
oracle	jre	`17.0.1`
netapp	7-mode_transition_tool	`-`
netapp	active_iq_unified_manager	`-`
netapp	cloud_insights_acquisition_unit	`-`
netapp	cloud_secure_agent	`-`
netapp	e-series_santricity_os_controller	`{"startIncluding":"11.0.0","endIncluding":"11.70.1"}`
netapp	e-series_santricity_storage_manager	`-`
netapp	e-series_santricity_web_services	`-`
netapp	hci_management_node	`-`
netapp	oncommand_insight	`-`
netapp	oncommand_workflow_automation	`-`
netapp	santricity_storage_plugin	`-`
netapp	santricity_unified_manager	`-`
netapp	snapmanager	`-`
netapp	solidfire	`-`
oracle	openjdk	`{"startIncluding":"11","endIncluding":"11.0.13"}`
oracle	openjdk	`7`
oracle	openjdk	`8`
oracle	openjdk	`17`
oracle	openjdk	`17.0.1`

References

CWEs

CWE-284

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.