Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2022-21449

Vulnerability identifier: #VU62397

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21449

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Oracle GraalVM Enterprise Edition
Red Hat OpenShift Serverless
SecurID Governance and Lifecycle
IBM Cloud Object Storage Systems
Dell EMC Data Protection Search
Debian Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
SUSE OpenStack Cloud Crowbar
Oracle Linux
SUSE OpenStack Cloud
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Legacy Software
openSUSE Leap
Ubuntu
openEuler
RSA Identity Governance and Lifecycle
API Manager
API Gateway
SecureTransport
Dell Policy Manager for Secure Connect Gateway (SCG)
EMC ECS
Dell EMC NetWorker Runtime Environment (NRE)
IBM Semeru Runtimes
Oracle Java SE
OpenJDK Java (for Middleware)
Zimbra Collaboration
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
openjdk-17 (debian package)
java-17-openjdk (Red Hat package)
java-1_7_1-ibm-alsa
java-1_7_1-ibm
java-1_7_1-ibm-devel
java-1_7_1-ibm-jdbc
java-1_7_1-ibm-plugin
java-1_8_0-ibm
java-1_8_0-ibm-alsa
java-1_8_0-ibm-plugin
java-1_8_0-ibm-devel
java-1_8_0-ibm-32bit
java-1_8_0-ibm-devel-32bit
java-1_8_0-ibm-demo
java-1_8_0-ibm-src
openjdk-8-jdk (Ubuntu package)
openjdk-8-jre-headless (Ubuntu package)
openjdk-8-jre (Ubuntu package)
openjdk-8-jre-zero (Ubuntu package)
openjdk-11 (Debian package)
openjdk-11-jre (Ubuntu package)
openjdk-11-jre-zero (Ubuntu package)
openjdk-11-jre-headless (Ubuntu package)
openjdk-11-jdk (Ubuntu package)
openjdk-17-jdk-headless (Ubuntu package)
openjdk-17-jre-headless (Ubuntu package)
openjdk-17-jre-zero (Ubuntu package)
openjdk-17-jre (Ubuntu package)
openjdk-17-jdk (Ubuntu package)
java-latest-openjdk
java-latest-openjdk-javadoc-zip
java-latest-openjdk-devel
java-latest-openjdk-headless
java-latest-openjdk-javadoc
java-latest-openjdk-debuginfo
java-latest-openjdk-src
java-latest-openjdk-demo
java-latest-openjdk-debugsource
java-latest-openjdk-jmods
openjdk-18-jre-headless (Ubuntu package)
openjdk-18-jre (Ubuntu package)
openjdk-18-jre-zero (Ubuntu package)
openjdk-18-jdk (Ubuntu package)
EMC Integrated Data Protection Appliance
IBM Cognos Command Center

Install updates from vendor's website.

API Manager - update to August 2022
API Gateway - update to August 2022
SecureTransport - update to 5.5-20220428
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.12.00.00
Zimbra Collaboration - addressed in versions 8.8.15 Patch 45, 9.0.0 Patch 38, 10.0.6
OpenJDK Java (for Middleware) - update to 17.0.3
openjdk-17 (debian package) - update to 17.0.3+7-1~deb11u1
java-17-openjdk (Red Hat package) - addressed in versions 17.0.3.0.6-2.el8_5, 17.0.3.0.7-1.el9_0
Red Hat OpenShift Serverless - update to 1
java-1_7_1-ibm-alsa - update to 1.7.1_sr5.10-38.71.1
java-1_7_1-ibm - update to 1.7.1_sr5.10-38.71.1
java-1_7_1-ibm-devel - update to 1.7.1_sr5.10-38.71.1
java-1_7_1-ibm-jdbc - update to 1.7.1_sr5.10-38.71.1
java-1_7_1-ibm-plugin - update to 1.7.1_sr5.10-38.71.1
java-1_8_0-ibm - addressed in versions 1.8.0_sr7.10-30.90.1, 1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr7.10-30.90.1, 1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr7.10-30.90.1, 1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr7.10-30.90.1, 1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-32bit - update to 1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-devel-32bit - update to 1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-demo - update to 1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-src - update to 1.8.0_sr7.10-150000.3.59.1
EMC Integrated Data Protection Appliance - update to 2.7.3
EMC ECS - update to 3.7.0.2
openjdk-8-jdk (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre-headless (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre-zero (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
Dell EMC NetWorker Runtime Environment (NRE) - update to 8.0.13
IBM Semeru Runtimes - addressed in versions 8.0.332.0, 11.0.15.0, 17.0.3.0, 18.0.1.0
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
openjdk-11 (Debian package) - addressed in versions 11.0.15+10-1~deb10u1, 11.0.15+10-1~deb11u1
openjdk-11-jre (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jre-zero (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jre-headless (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jdk (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-17-jdk-headless (Ubuntu package) - addressed in versions 17.0.3+7-0ubuntu0.18.04.1, 17.0.3+7-0ubuntu0.20.04.1, 17.0.3+7-0ubuntu0.21.10.1, 17.0.3+7-0ubuntu0.22.04.1
openjdk-17-jre-headless (Ubuntu package) - addressed in versions 17.0.3+7-0ubuntu0.18.04.1, 17.0.3+7-0ubuntu0.20.04.1, 17.0.3+7-0ubuntu0.21.10.1, 17.0.3+7-0ubuntu0.22.04.1, 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jre-zero (Ubuntu package) - addressed in versions 17.0.3+7-0ubuntu0.18.04.1, 17.0.3+7-0ubuntu0.20.04.1, 17.0.3+7-0ubuntu0.21.10.1, 17.0.3+7-0ubuntu0.22.04.1, 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jre (Ubuntu package) - addressed in versions 17.0.3+7-0ubuntu0.18.04.1, 17.0.3+7-0ubuntu0.20.04.1, 17.0.3+7-0ubuntu0.21.10.1, 17.0.3+7-0ubuntu0.22.04.1, 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jdk (Ubuntu package) - addressed in versions 17.0.3+7-0ubuntu0.18.04.1, 17.0.3+7-0ubuntu0.20.04.1, 17.0.3+7-0ubuntu0.21.10.1, 17.0.3+7-0ubuntu0.22.04.1, 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
java-latest-openjdk - update to 18.0.1.10-0.rolling
java-latest-openjdk-javadoc-zip - update to 18.0.1.10-0.rolling
java-latest-openjdk-devel - update to 18.0.1.10-0.rolling
java-latest-openjdk-headless - update to 18.0.1.10-0.rolling
java-latest-openjdk-javadoc - update to 18.0.1.10-0.rolling
java-latest-openjdk-debuginfo - update to 18.0.1.10-0.rolling
java-latest-openjdk-src - update to 18.0.1.10-0.rolling
java-latest-openjdk-demo - update to 18.0.1.10-0.rolling
java-latest-openjdk-debugsource - update to 18.0.1.10-0.rolling
java-latest-openjdk-jmods - update to 18.0.1.10-0.rolling
openjdk-18-jre-headless (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jre (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jre-zero (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jdk (Ubuntu package) - update to 18.0.2+9-2~22.04
Dell EMC Data Protection Search - update to 19.6.1

• Exploit #8139 - CVE-2022-21449-TLS-PoC (CVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server) (July 14, 2022)
• Exploit #7688 - SignChecker (Test tool to demonstrate the vulnerability of CVE-2022-21449) (April 25, 2022)
• Exploit #7673 - CVE-2022-21449-TLS-PoC (CVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server) (April 21, 2022)
• Exploit #7672 - jfrog-CVE-2022-21449 () (April 21, 2022)
• Exploit #7671 - CVE-2022-21449-vuln-test (CVE-2022-21449 Vulnerability tester) (April 21, 2022)

• https://www.oracle.com/security-alerts/cpuapr2022.html

• Multiple vulnerabilities in Oracle Java SE
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Red Hat Enterprise Linux 8 update for java-17-openjdk
• Ubuntu update for openjdk-17
• Multiple vulnerabilities in Red Hat build of OpenJDK 17
• Debian update for openjdk-17
• Multiple vulnerabilities in Oracle Linux
• SUSE update for java-1_7_1-ibm
• SUSE update for java-1_8_0-ibm
• Multiple vulnerabilities in Dell Policy Manager for Secure Connect Gateway
• Multiple vulnerabilities in Dell Data Protection Search
• SUSE update for java-1_8_0-ibm
• Ubuntu update for openjdk-8
• Ubuntu update for openjdk-17
• Debian update for openjdk-11
• Multiple vulnerabilities in IBM Cloud Object Storage Systems
• Multiple vulnerabilities in Dell Elastic Cloud Storage (ECS)
• Multiple vulnerabilities in Dell NetWorker Runtime Environment (NRE)
• Red Hat Enterprise Linux 9 update for java-17-openjdk
• Multiple vulnerabilities in API Gateway and API Manager
• Multiple vulnerabilities in Axway SecureTransport (April 2022)
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in Zimbra
• openEuler update for openjdk-latest
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in IBM Semeru Runtime
• RSA Governance and Lifecycle update for Oracle Databse