Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2022-21271

Vulnerability identifier: #VU59728

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21271

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Oracle GraalVM Enterprise Edition
Solutions Enabler Virtual Appliance
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Oracle Solaris
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise High Performance Computing
openEuler
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Maximo Application Suite
Oracle Java SE
java-1_7_0-ibm-plugin
java-1_7_0-ibm-jdbc
java-1_7_0-ibm-devel
java-1_7_0-ibm-alsa
java-1_7_0-ibm
java-1_7_1-ibm-plugin
java-1_7_1-ibm-alsa
java-1_7_1-ibm-jdbc
java-1_7_1-ibm-devel
java-1_7_1-ibm
java
java-1_8_0-ibm-devel
java-1_8_0-ibm-alsa
java-1_8_0-ibm
java-1_8_0-ibm-plugin
java-11-openjdk-slowdebug
java-11-openjdk-demo
java-11-openjdk-debuginfo
java-11-openjdk-jmods
java-11-openjdk-headless
java-11-openjdk-javadoc
java-11-openjdk-src-slowdebug
java-11-openjdk-demo-slowdebug
java-11-openjdk-jmods-slowdebug
java-11-openjdk-src
java-11-openjdk-devel-slowdebug
java-11-openjdk-devel
java-11-openjdk-javadoc-zip
java-11-openjdk-headless-slowdebug
java-11-openjdk
java-11-openjdk-debugsource
Brocade SANnav
EMC ECS
Dell EMC NetWorker Runtime Environment (NRE)
Solutions Enabler
Unisphere 360
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
VASA Provider Standalone
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
EMC ESRS Policy Manager

Install updates from vendor's website.

java-1_7_0-ibm-plugin - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm-jdbc - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm-devel - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm-alsa - update to 1.7.0_sr11.5-65.66.1
java-1_7_0-ibm - update to 1.7.0_sr11.5-65.66.1
java-1_7_1-ibm-plugin - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm-alsa - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm-jdbc - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm-devel - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java-1_7_1-ibm - addressed in versions 1.7.1_sr5.5-26.71.2, 1.7.1_sr5.5-38.68.1
java - addressed in versions 1.8.0-openjdk-devel-1.8.0.352.b08-3, 1.8.0-openjdk-devel-slowdebug-1.8.0.352.b08-3, 1.8.0-openjdk-openjfx-devel-1.8.0.352.b08-3, 1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.352.b08-3, 1.8.0-openjdk-accessibility-1.8.0.352.b08-3, 1.8.0-openjdk-accessibility-slowdebug-1.8.0.352.b08-3, 1.8.0-openjdk-1.8.0.352.b08-3, 1.8.0-openjdk-src-1.8.0.352.b08-3, 1.8.0-openjdk-src-slowdebug-1.8.0.352.b08-3, 1.8.0-openjdk-debugsource-1.8.0.352.b08-3, 1.8.0-openjdk-debuginfo-1.8.0.352.b08-3, 1.8.0-openjdk-demo-1.8.0.352.b08-3, 1.8.0-openjdk-demo-slowdebug-1.8.0.352.b08-3, 1.8.0-openjdk-headless-1.8.0.352.b08-3, 1.8.0-openjdk-headless-slowdebug-1.8.0.352.b08-3, 1.8.0-openjdk-javadoc-1.8.0.352.b08-3, 1.8.0-openjdk-javadoc-zip-1.8.0.352.b08-3, 1.8.0-openjdk-openjfx-1.8.0.352.b08-3, 1.8.0-openjdk-openjfx-slowdebug-1.8.0.352.b08-3, 1.8.0-openjdk-slowdebug-1.8.0.352.b08-3
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr7.5-30.87.1, 1.8.0_sr7.5-150000.3.56.1
Brocade SANnav - update to 2.2.0.2
EMC ECS - update to 3.7.0.2
Dell EMC Unity Operating Environment (OE) - update to 5.2.2.0.5.004
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.2.0.5.004
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.2.0.5.004
EMC ESRS Policy Manager - update to 5.10.00.00
Dell EMC NetWorker Runtime Environment (NRE) - update to 8.0.12
IBM Maximo Application Suite - update to 8.8.2
Solutions Enabler - addressed in versions 9.1.0.19, 9.2.3.1
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.19, 9.2.3.1
Unisphere 360 - addressed in versions 9.1.0.30, 9.2.3.4
Unisphere for PowerMax - addressed in versions 9.1.0.32, 9.2.3.11
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.32, 9.2.3.11
VASA Provider Standalone - addressed in versions 9.1.0.724, 9.2.3.10
java-11-openjdk-slowdebug - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-demo - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-debuginfo - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-jmods - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-headless - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-javadoc - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-src-slowdebug - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-demo-slowdebug - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-jmods-slowdebug - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-src - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-devel-slowdebug - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-devel - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-javadoc-zip - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-headless-slowdebug - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk - addressed in versions 11.0.17.8-0, 11.0.17.8-1
java-11-openjdk-debugsource - addressed in versions 11.0.17.8-0, 11.0.17.8-1

• https://www.oracle.com/security-alerts/cpujan2022.html

• Multiple vulnerabilities in Oracle Java SE
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in Oracle Solaris
• Multiple vulnerabilities in Brocade SANnav
• Gentoo update for OpenJDK
• Multiple vulnerabilities in Dell Elastic Cloud Storage (ECS)
• Multiple vulnerabilities in Dell EMC NetWorker Runtime Environment (NRE)
• Multiple vulnerabilities in Dell EMC Policy Manager
• Multiple vulnerabilities in Dell Unisphere for PowerMax, Dell Solutions Enabler, Dell Unisphere 360 and Dell VASA Provider
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• SUSE update for java-1_7_0-ibm
• SUSE update for java-1_7_1-ibm
• SUSE update for java-1_7_1-ibm
• SUSE update for java-1_8_0-ibm
• SUSE update for java-1_8_0-ibm
• Improper input validation in IBM Maximo Application Suite - Monitor Component
• openEuler update for openjdk-1.8.0
• openEuler 22.03 LTS update for openjdk-11
• openEuler 20.03 LTS SP1 update for openjdk-11
• openEuler 20.03 LTS SP3 update for openjdk-11
• Improper input validation in IBM Watson Assistant for IBM Cloud Pack for Data