Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2022-21349

Vulnerability identifier: #VU59718

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21349

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the 2D component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Oracle GraalVM Enterprise Edition
Solutions Enabler Virtual Appliance
SecurID Governance and Lifecycle
IBM Cloud Application Business Insights
Netcool Operations Insight
IBM Cloud Transformation Advisor
IBM IoT MessageSight
IBM WIoTP MessageGateway
Dell Secure Connect Gateway
Tivoli Composite Application Manager for Transactions
CICS Transaction Gateway
IBM TXSeries for Multiplatforms
IBM Operations Analytics Predictive Insights
App Connect Enterprise Certified Container
IBM Sterling Connect:Direct Web Services
IBM Tivoli Monitoring
IBM Workload Scheduler
RSA Identity Governance and Lifecycle
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
IBM i
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise High Performance Computing
openEuler
Fedora
SecureTransport
Oracle Java SE
IBM CICS TX Standard
IBM CICS TX Advanced
Event Streams
EMC ESRS Policy Manager
IBM Cognos Controller
java-1_7_0-ibm
java-1_7_0-ibm-plugin
java-1_7_0-ibm-jdbc
java-1_7_0-ibm-devel
java-1_7_0-ibm-alsa
java-1.7.0-openjdk
java-1_7_1-ibm
java-1_7_1-ibm-devel
java-1_7_1-ibm-jdbc
java-1_7_1-ibm-alsa
java-1_7_1-ibm-plugin
java
java-1_8_0-ibm-alsa
java-1_8_0-ibm
java-1_8_0-ibm-devel
java-1_8_0-ibm-plugin
java-1.8.0-openjdk
java-1_8_0-openjdk-headless-debuginfo
java-1_8_0-openjdk-headless
java-1_8_0-openjdk-devel-debuginfo
java-1_8_0-openjdk-devel
java-1_8_0-openjdk-demo-debuginfo
java-1_8_0-openjdk-demo
java-1_8_0-openjdk-debugsource
java-1_8_0-openjdk-debuginfo
java-1_8_0-openjdk
Brocade SANnav
EMC ECS
Dell EMC NetWorker Runtime Environment (NRE)
Solutions Enabler
Unisphere 360
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
VASA Provider Standalone
IBM DB2
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install updates from vendor's website.

IBM Cloud Application Business Insights - addressed in versions 1.1.6.6 Fix Pack, 1.1.7.4 Fix Pack
Netcool Operations Insight - update to 1.6.5
IBM Cloud Transformation Advisor - update to 3.1.0
IBM WIoTP MessageGateway - update to 5.0.0.2
Dell Secure Connect Gateway - update to 5.12.00.10
SecureTransport - update to 5.5-20220331
Event Streams - update to 10.5.0
IBM Operations Analytics Predictive Insights - update to 1.3.6.6
java-1_7_0-ibm - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm-plugin - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm-jdbc - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm-devel - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm-alsa - update to 1.7.0_sr11.5-65.66.1
java-1.7.0-openjdk - update to 1.7.0.321-2.6.28.1.86
java-1_7_1-ibm - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm-devel - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm-jdbc - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm-alsa - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm-plugin - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java - addressed in versions 1.8.0-openjdk-devel-1.8.0.342.b07-0, 1.8.0-openjdk-devel-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-devel-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-accessibility-1.8.0.342.b07-0, 1.8.0-openjdk-accessibility-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-1.8.0.342.b07-0, 1.8.0-openjdk-src-1.8.0.342.b07-0, 1.8.0-openjdk-src-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-debuginfo-1.8.0.342.b07-0, 1.8.0-openjdk-debugsource-1.8.0.342.b07-0, 1.8.0-openjdk-demo-1.8.0.342.b07-0, 1.8.0-openjdk-demo-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-headless-1.8.0.342.b07-0, 1.8.0-openjdk-headless-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-javadoc-1.8.0.342.b07-0, 1.8.0-openjdk-javadoc-zip-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-slowdebug-1.8.0.342.b07-0
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
java-1.8.0-openjdk - addressed in versions 1.8.0.322.b06-2.fc34, 1.8.0.322.b06-2.fc35
java-1_8_0-openjdk-headless-debuginfo - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk-headless - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk-devel-debuginfo - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk-devel - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk-demo-debuginfo - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk-demo - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk-debugsource - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk-debuginfo - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
java-1_8_0-openjdk - addressed in versions 1.8.0.322-3.64.2, 1.8.0.322-27.72.2
Brocade SANnav - update to 2.2.0.2
EMC ECS - update to 3.7.0.2
App Connect Enterprise Certified Container - update to 5.0.0
IBM DB2 - update to 5.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.2.0.5.004
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.2.0.5.004
Dell EMC Unity Operating Environment (OE) - update to 5.2.2.0.5.004
EMC ESRS Policy Manager - update to 5.10.00.00
IBM Sterling Connect:Direct Web Services - addressed in versions 6.0.0.8, 6.1.0.12, 6.2.0.6
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 12
Dell EMC NetWorker Runtime Environment (NRE) - update to 8.0.12
Solutions Enabler - addressed in versions 9.1.0.19, 9.2.3.1
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.19, 9.2.3.1
Unisphere 360 - addressed in versions 9.1.0.30, 9.2.3.4
Unisphere for PowerMax - addressed in versions 9.1.0.32, 9.2.3.11
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.32, 9.2.3.11
VASA Provider Standalone - addressed in versions 9.1.0.724, 9.2.3.10
IBM Workload Scheduler - addressed in versions 9.4.0.7, 9.5.0.6
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix9, 11.1.0.0 ifix2
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2

• https://www.oracle.com/security-alerts/cpujan2022.html

• Multiple vulnerabilities in Oracle Java SE
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in IBM i
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Service
• Multiple vulnerabilities in IBM WIoTP MessageGateway/IoT MessageSight
• Multiple vulnerabilities in IBM Cloud Application Business Insights
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM Tivoli Composite Application Manager for Transactions
• Multiple vulnerabilities in IBM CICS Transaction Gateway
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in Brocade SANnav
• Amazon Linux AMI update for java-1.8.0-openjdk
• Gentoo update for OpenJDK
• Amazon Linux AMI update for java-1.7.0-openjdk
• Multiple vulnerabilities in IBM Workload Scheduler
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Dell Elastic Cloud Storage (ECS)
• Multiple vulnerabilities in Dell EMC NetWorker Runtime Environment (NRE)
• Multiple vulnerabilities in Dell EMC Policy Manager
• Multiple vulnerabilities in Dell Unisphere for PowerMax, Dell Solutions Enabler, Dell Unisphere 360 and Dell VASA Provider
• IBM Operations Analytics Predictive Insights update for IBM Java
• IBM Tivoli Monitoring update for IBM Java
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• SUSE update for java-1_8_0-openjdk
• SUSE update for java-1_8_0-openjdk
• SUSE update for java-1_7_0-ibm
• SUSE update for java-1_7_1-ibm
• SUSE update for java-1_7_1-ibm
• SUSE update for java-1_8_0-ibm
• SUSE update for java-1_8_0-ibm
• Axway SecureTransport update for OpenJDK JRE (March 2022)
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Cognos Controller
• Improper input validation in IBM App Connect Enterprise Certified Container
• openEuler update for openjdk-1.8.0
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data
• Fedora 34 update for java-1.8.0-openjdk
• Fedora 35 update for java-1.8.0-openjdk
• RSA Governance and Lifecycle update for Oracle Databse