VIR Vulnerability Intelligence Relay

CVE-2022-21340

medium
Published 2022-01-19 · Modified 2022-03-21
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.3

Description

RHSA-2022:0970: java-1.8.0-ibm security update (Moderate)

Predictions

Exploit likelihood
63%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026) CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Errata / fixed releases ProductPackageAdvisoryReleased Red Hat Build of OpenJDK 11.0.14RHSA-2022:02282022-01-24T00:00:00Z Red Hat Build of OpenJDK 11.0.14RHSA-2022:02292022-01-24T00:00:00Z Red Hat Build of OpenJDK…

Description

OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)

CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Errata / fixed releases

ProductPackageAdvisoryReleased
Red Hat Build of OpenJDK 11.0.14RHSA-2022:02282022-01-24T00:00:00Z
Red Hat Build of OpenJDK 11.0.14RHSA-2022:02292022-01-24T00:00:00Z
Red Hat Build of OpenJDK 17.0.2RHSA-2022:01662022-01-24T00:00:00Z
Red Hat Build of OpenJDK 17.0.2WindowsRHSA-2022:01652022-01-24T00:00:00Z
Red Hat Build of OpenJDK 8u322RHSA-2022:03172022-01-27T00:00:00Z
Red Hat Build of OpenJDK 8u322RHSA-2022:03212022-01-27T00:00:00Z
Red Hat Enterprise Linux 7java-11-openjdk-1:11.0.14.0.9-1.el7_9RHSA-2022:02042022-01-24T00:00:00Z
Red Hat Enterprise Linux 7java-1.8.0-openjdk-1:1.8.0.322.b06-1.el7_9RHSA-2022:03062022-01-27T00:00:00Z
Red Hat Enterprise Linux 7 Supplementaryjava-1.8.0-ibm-1:1.8.0.7.5-1jpp.1.el7RHSA-2022:09682022-03-21T00:00:00Z
Red Hat Enterprise Linux 7 Supplementaryjava-1.7.1-ibm-1:1.7.1.5.5-1jpp.1.el7RHSA-2022:09692022-03-21T00:00:00Z
Red Hat Enterprise Linux 8java-17-openjdk-1:17.0.2.0.8-4.el8_5RHSA-2022:01612022-01-19T00:00:00Z
Red Hat Enterprise Linux 8java-11-openjdk-1:11.0.14.0.9-2.el8_5RHSA-2022:01852022-01-24T00:00:00Z
Red Hat Enterprise Linux 8java-1.8.0-openjdk-1:1.8.0.322.b06-2.el8_5RHSA-2022:03072022-01-27T00:00:00Z
Red Hat Enterprise Linux 8java-1.8.0-ibm-1:1.8.0.7.5-1.el8_5RHSA-2022:09702022-03-21T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutionsjava-11-openjdk-1:11.0.14.0.9-1.el8_1RHSA-2022:02332022-01-24T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutionsjava-1.8.0-openjdk-1:1.8.0.322.b06-1.el8_1RHSA-2022:03042022-01-27T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Supportjava-11-openjdk-1:11.0.14.0.9-1.el8_2RHSA-2022:02092022-01-24T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Supportjava-1.8.0-openjdk-1:1.8.0.322.b06-1.el8_2RHSA-2022:03052022-01-27T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Supportjava-11-openjdk-1:11.0.14.0.9-2.el8_4RHSA-2022:02112022-01-24T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Supportjava-1.8.0-openjdk-1:1.8.0.322.b06-2.el8_4RHSA-2022:03122022-01-27T00:00:00Z

Package state

ProductPackageState
Red Hat build of OpenJDK 11LinuxAffected
Red Hat build of OpenJDK 11WindowsAffected
Red Hat build of OpenJDK 17LinuxAffected
Red Hat build of OpenJDK 1.8LinuxAffected
Red Hat build of OpenJDK 1.8WindowsAffected
Red Hat Enterprise Linux 6java-1.6.0-openjdkOut of support scope
Red Hat Enterprise Linux 6java-1.7.0-openjdkOut of support scope
Red Hat Enterprise Linux 6java-1.8.0-openjdkOut of support scope
Red Hat Enterprise Linux 7java-1.6.0-openjdkOut of support scope
Red Hat Enterprise Linux 7java-1.7.0-openjdkOut of support scope

Apply commands

bash fix
Apply RHSA-2022:0165 for Red Hat Build of OpenJDK 17.0.2
yum update -y Windows
# or:
dnf upgrade -y Windows

Affected

VendorProductVersion
redhatRed Hat build of OpenJDK 11Affected
redhatRed Hat build of OpenJDK 11Affected
redhatRed Hat build of OpenJDK 17Affected
redhatRed Hat build of OpenJDK 1.8Affected
redhatRed Hat build of OpenJDK 1.8Affected

OS impact
OSVersionStatusFixed in
suse slesaffected
rockylinux rocky8fixed
debian debian9.0affected
debian debian10.0affected
debian debian11.0affected
debian debianbullseyefixed11.0.14+9-1~deb11u1
debian debiansidfixed11.0.14+9-1
debian debianbookwormfixed17.0.2+8-1
redhat rhel8fixed

Application impact
VendorProductVersionsFixed
oracle oraclegraalvm20.3.4
oracle oraclegraalvm21.3.0
oracle oraclejdk1.7.0
oracle oraclejdk1.8.0
oracle oraclejdk11.0.13
oracle oraclejdk17.0.1
oracle oraclejre1.7.0
oracle oraclejre1.8.0
oracle oraclejre11.0.13
oracle oraclejre17.0.1
netapp7-mode_transition_tool-
netappactive_iq_unified_manager-
netappcloud_insights_acquisition_unit-
netappcloud_secure_agent-
netappe-series_santricity_os_controller{"startIncluding":"11.0.0","endIncluding":"11.70.1"}
netappe-series_santricity_storage_manager-
netappe-series_santricity_web_services-
netapphci_management_node-
netapponcommand_insight-
netapponcommand_workflow_automation-
netappsantricity_storage_plugin-
netappsantricity_unified_manager-
netappsnapmanager-
netappsolidfire-
oracle oracleopenjdk{"startIncluding":"11","endIncluding":"11.0.13"}
oracle oracleopenjdk7
oracle oracleopenjdk8
oracle oracleopenjdk17
oracle oracleopenjdk17.0.1
oracle oraclegraalvm20.3.4
oracle oraclegraalvm21.3.0
oracle oraclejdk1.7.0
oracle oraclejdk1.8.0
oracle oraclejdk11.0.13
oracle oraclejdk17.0.1
oracle oraclejre1.7.0
oracle oraclejre1.8.0
oracle oraclejre11.0.13
oracle oraclejre17.0.1
netapp7-mode_transition_tool-
netappactive_iq_unified_manager-
netappcloud_insights_acquisition_unit-
netappcloud_secure_agent-
netappe-series_santricity_os_controller{"startIncluding":"11.0.0","endIncluding":"11.70.1"}
netappe-series_santricity_storage_manager-
netappe-series_santricity_web_services-
netapphci_management_node-
netapponcommand_insight-
netapponcommand_workflow_automation-
netappsantricity_storage_plugin-
netappsantricity_unified_manager-
netappsnapmanager-
netappsolidfire-
oracle oracleopenjdk{"startIncluding":"11","endIncluding":"11.0.13"}
oracle oracleopenjdk7
oracle oracleopenjdk8
oracle oracleopenjdk17
oracle oracleopenjdk17.0.1

References

CWEs

CWE-400

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.