Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2022-34169

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU65495

Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2022-34169

Published: July 20, 2022 / Updated: January 20, 2025


Vulnerability identifier: #VU65495
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-34169
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to compromise the affected system.

The vulnerability exists due to an integer truncation issue when processing malicious XSLT stylesheets. A remote non-authenticated attacker can pass specially crafted data to the application to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.


Affected software

Oracle GraalVM Enterprise Edition
Bosh Release for the UAA
Red Hat OpenShift Serverless
Solutions Enabler Virtual Appliance
Amazon Linux AMI
Debian Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Red Hat Enterprise Linux Workstation
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
SUSE Linux Enterprise Storage
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
Ubuntu
openEuler
Fedora
SecurID Governance and Lifecycle
z/Transaction Processing Facility ( z/TPF)
Netcool Operations Insight
Oracle Product Lifecycle Analytics
IBM Watson Knowledge Catalog in Cloud Pak for Data
Dell Secure Connect Gateway
OpenShift Logging
Oracle Communications Unified Inventory Management
Oracle Financial Services Enterprise Case Management
Jira Software Data Center
Oracle Communications EAGLE Element Management System
Unified OSS Console Assurance Monitoring (UOCAM)
Red Hat Integration Camel Extensions for Quarkus
IBM Sterling Secure Proxy
IBM Sterling B2B Integrator
Tivoli Composite Application Manager for Transactions
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Business Automation Workflow
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
Operations Analytics - Log Analysis
Oracle Agile Engineering Data Management
Oracle Transportation Management
Rational Performance Tester
DevOps Test Performance
Oracle Business Intelligence Enterprise Edition
Oracle Communications Policy Management
IBM Planning Analytics Workspace
Cloud Pak for Network Automation
PowerStore T
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
IBM Semeru Runtimes
Maximo Application Suite - IoT Component
Solutions Enabler
Unisphere 360
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
eVASA Provider Virtual Appliance
VASA Provider Standalone
Cognos Transformer
RSA Identity Governance and Lifecycle
API Gateway
JBoss Enterprise Application Platform
API Manager
Oracle Financial Services Compliance Studio
Oracle Insurance Policy Administration
Oracle Retail Extract Tranform and Load
Apache Xalan-Java
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
Traffix SDC
Oracle Autovue for Agile Product Lifecycle Management
Oracle Financial Services Revenue Management and Billing
Siebel CRM Deployment
IBM Content Navigator
IBM App Connect for Healthcare
IBM Qradar SIEM
Oracle Outside In Technology
Jira Software Server
SecureTransport
Oracle Java SE
OpenJDK Java (for Middleware)
Oracle Agile PLM Framework
Red Hat Camel for Spring Boot
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openjdk-11 (Debian package)
java-11-openjdk (Red Hat package)
SUSE Linux Enterprise Module for Packagehub Subpackages
openjdk-17 (debian package)
java-17-openjdk (Red Hat package)
eap7-jboss-annotations (Red Hat package)
eap8-asyncutil (Red Hat package)
eap8-hppc (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap8-cryptacular (Red Hat package)
eap7-h2database (Red Hat package)
eap7-ironjacamar (Red Hat package)
java-1.7.0-openjdk
java-1_7_1-ibm-plugin
java-1_7_1-ibm-jdbc
java-1_7_1-ibm
java-1_7_1-ibm-alsa
java-1_7_1-ibm-devel
eap7-jboss-server-migration (Red Hat package)
eap7-avro (Red Hat package)
java
java-1_8_0-ibm
java-1_8_0-ibm-alsa
java-1_8_0-ibm-devel
java-1_8_0-ibm-plugin
java-1_8_0-ibm-devel-32bit
java-1_8_0-ibm-32bit
java-1_8_0-ibm-src
java-1_8_0-ibm-demo
eap8-aesh-extensions (Red Hat package)
java-1.8.0-openjdk
java-1.8.0-openjdk-demo
java-1.8.0-openjdk-demo-debug
java-1.8.0-openjdk-accessibility-debug
java-1.8.0-openjdk-accessibility
java-1.8.0-openjdk-devel
java-1.8.0-openjdk-headless
java-1.8.0-openjdk-javadoc-zip-debug
java-1.8.0-openjdk-javadoc-zip
java-1.8.0-openjdk-javadoc-debug
java-1.8.0-openjdk-devel-debug
java-1.8.0-openjdk-debug
java-1.8.0-openjdk-javadoc
java-1.8.0-openjdk-src-debug
java-1.8.0-openjdk-src
java-1.8.0-openjdk-headless-debug
java-1.8.0-openjdk (Red Hat package)
java-1_8_0-openjdk-headless
java-1_8_0-openjdk
java-1_8_0-openjdk-debuginfo
java-1_8_0-openjdk-debugsource
java-1_8_0-openjdk-demo
java-1_8_0-openjdk-demo-debuginfo
java-1_8_0-openjdk-devel
java-1_8_0-openjdk-devel-debuginfo
java-1_8_0-openjdk-headless-debuginfo
java-1_8_0-openjdk-javadoc
java-1_8_0-openjdk-accessibility
java-1_8_0-openjdk-src
java-1_8_0-openj9-accessibility
java-1_8_0-openj9-headless-debuginfo
java-1_8_0-openj9-headless
java-1_8_0-openj9-devel-debuginfo
java-1_8_0-openj9-devel
java-1_8_0-openj9-demo-debuginfo
java-1_8_0-openj9-demo
java-1_8_0-openj9-debugsource
java-1_8_0-openj9-debuginfo
java-1_8_0-openj9-javadoc
java-1_8_0-openj9
java-1_8_0-openj9-src
eap8-aws-java-sdk (Red Hat package)
eap7-jsoup (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap7-bouncycastle (Red Hat package)
eap8-artemis-native (Red Hat package)
eap8-activemq-artemis-native (Red Hat package)
eap8-artemis-wildfly-integration (Red Hat package)
eap8-resteasy-extensions (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-fastinfoset (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-aesh-readline (Red Hat package)
eap7-xml-security (Red Hat package)
eap8-pem-keystore (Red Hat package)
eap7-wss4j (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-log4j (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package)
eap8-resteasy-spring (Red Hat package)
eap8-saaj-impl (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap8-apache-commons-collections (Red Hat package)
eap7-hal-console (Red Hat package)
eap8-jboss-logging (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-jctools (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap8-jgroups (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap8-narayana (Red Hat package)
eap7-hibernate-validator (Red Hat package)
bcel
eap8-hibernate (Red Hat package)
bcel (Debian package)
dev-java/bcel
eap7-wildfly (Red Hat package)
openjdk-8-jdk (Ubuntu package)
openjdk-8-jre-headless (Ubuntu package)
openjdk-8-jre (Ubuntu package)
openjdk-8-jre-zero (Ubuntu package)
eap8-shibboleth-java-support (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-objectweb-asm (Red Hat package)
eap8-nimbus-jose-jwt (Red Hat package)
java-11-openjdk-headless
java-11-openjdk-devel
java-11-openjdk-demo
java-11-openjdk-debugsource
java-11-openjdk
java-11-openjdk-javadoc
java-11-openjdk-static-libs-debug
java-11-openjdk-static-libs
java-11-openjdk-src-debug
java-11-openjdk-src
java-11-openjdk-jmods-debug
java-11-openjdk-javadoc-zip-debug
java-11-openjdk-jmods
java-11-openjdk-javadoc-zip
java-11-openjdk-debug
java-11-openjdk-demo-debug
java-11-openjdk-devel-debug
java-11-openjdk-headless-debug
java-11-openjdk-javadoc-debug
java-11-openjdk-accessibility-debuginfo
java-11-openjdk-accessibility
java-11-openjdk-headless-slowdebug
java-11-openjdk-debuginfo
java-11-openjdk-slowdebug
java-11-openjdk-src-slowdebug
java-11-openjdk-jmods-slowdebug
java-11-openjdk-devel-slowdebug
java-11-openjdk-demo-slowdebug
openjdk-11-jre (Ubuntu package)
openjdk-11-jre-zero (Ubuntu package)
openjdk-11-jdk (Ubuntu package)
openjdk-11-jre-headless (Ubuntu package)
java-17-openjdk
java-17-openjdk-static-libs
java-17-openjdk-src
java-17-openjdk-jmods
java-17-openjdk-javadoc-zip
java-17-openjdk-javadoc
java-17-openjdk-demo
java-17-openjdk-devel
java-17-openjdk-headless
java-17-openjdk-accessibility-debuginfo
java-17-openjdk-debuginfo
java-17-openjdk-debugsource
java-17-openjdk-headless-debuginfo
java-17-openjdk-devel-debuginfo
java-17-openjdk-accessibility
openjdk-17-jdk (Ubuntu package)
openjdk-17-jre-zero (Ubuntu package)
openjdk-17-jre (Ubuntu package)
openjdk-17-jre-headless (Ubuntu package)
java-latest-openjdk
java-latest-openjdk-jmods
java-latest-openjdk-debuginfo
java-latest-openjdk-javadoc
java-latest-openjdk-headless
java-latest-openjdk-devel
java-latest-openjdk-debugsource
java-latest-openjdk-javadoc-zip
java-latest-openjdk-demo
java-latest-openjdk-src
openjdk-18-jre-zero (Ubuntu package)
openjdk-18-jre (Ubuntu package)
openjdk-18-jre-headless (Ubuntu package)
openjdk-18-jdk (Ubuntu package)
eap8-eap-product-conf-parent (Red Hat package)
PeopleSoft Enterprise PeopleTools
Oracle Documaker
Oracle AutoVue
Operational Decision Manager
IBM API Connect
IBM Cognos Analytics
Oracle Commerce Guided Search
Cloud Foundry UAA
Dell EMC Storage Monitoring and Reporting (SMR)
IBM DB2
Dell EMC VxRail Appliance

How to mitigate CVE-2022-34169

Install updates from vendor's website.

API Gateway - update to August 2022
API Manager - update to August 2022
Operations Analytics - Log Analysis - update to 1.3.8.3 IF1
Netcool Operations Insight - update to 1.6.15
Apache Xalan-Java - update to 2.7.3
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Content Navigator - addressed in versions 3.0.15 IF009, 3.1.0 IF008, 3.2.0 IF004
Red Hat OpenShift Container Platform - addressed in versions 3.11.784, 4.6.61, 4.7.56, 4.9.45, 4.10.25
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Dell Secure Connect Gateway - update to 5.14.00.10
OpenShift Logging - addressed in versions 5.2.13, 5.3.10
Traffix SDC - update to 5.2.2
SecureTransport - update to 5.5-20220825
Oracle Agile Engineering Data Management - update to 6.2.1.8
JBoss Enterprise Application Platform - addressed in versions 7.1.8, 7.3.11, 7.4.19, 8.0.4
IBM Qradar SIEM - update to 7.5.0 Update Pack 7 IF06
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF06
OpenJDK Java (for Middleware) - addressed in versions 8.0.342, 11.0.16, 17.0.4
Jira Software Server - addressed in versions 9.4.18, 9.8.0
Jira Software Data Center - update to 9.8.0
DevOps Test Performance - update to 11.0.7
openjdk-11 (Debian package) - addressed in versions 11.0.16+8-1~deb10u1, 11.0.16+8-1~deb11u1
java-11-openjdk (Red Hat package) - addressed in versions 11.0.16.0.8-1.el7_9, 11.0.16.0.8-1.el8_1, 11.0.16.0.8-1.el8_2, 11.0.16.0.8-1.el8_4, 11.0.16.0.8-1.el8_6, 11.0.16.0.8-1.el9_0
openjdk-17 (debian package) - update to 17.0.4+8-1~deb11u1
java-17-openjdk (Red Hat package) - addressed in versions 17.0.4.0.8-2.el8_6, 17.0.4.0.8-2.el9_0
Cloud Foundry UAA - update to 75.22.0
Bosh Release for the UAA - update to 75.22.0
eap7-jboss-annotations (Red Hat package) - update to api_1.3_spec-2.0.1-4.Final_redhat_00001.1.el7eap
eap8-asyncutil (Red Hat package) - addressed in versions 0.1.0-2.redhat_00010.1.el8eap, 0.1.0-2.redhat_00010.1.el9eap
eap8-hppc (Red Hat package) - addressed in versions 0.8.1-2.redhat_00001.1.el8eap, 0.8.1-2.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-log4j-jboss-logmanager (Red Hat package) - update to 1.2.2-2.Final_redhat_00002.1.el7eap
eap8-cryptacular (Red Hat package) - addressed in versions 1.2.5-2.redhat_00001.1.el8eap, 1.2.5-2.redhat_00001.1.el9eap
eap7-h2database (Red Hat package) - addressed in versions 1.4.197-2.redhat_00005.1.ep7.el7, 1.4.197-3.redhat_00004.1.el7eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.18-1.Final_redhat_00001.1.el7eap, 1.5.18-1.Final_redhat_00001.1.el8eap, 1.5.18-1.Final_redhat_00001.1.el9eap
java-1.7.0-openjdk - update to 1.7.0.321-2.6.28.1.86
java-1_7_1-ibm-plugin - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm-jdbc - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm-alsa - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm-devel - update to 1.7.1_sr5.15-38.74.1
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.7.2-12.Final_redhat_00013.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el8eap, 1.10.0-39.Final_redhat_00039.1.el9eap
eap7-avro (Red Hat package) - addressed in versions 1.7.6-2.redhat_00003.1.ep7.el7, 1.7.6-8.redhat_00003.1.el7eap
java - addressed in versions 1.8.0-openjdk-devel-1.8.0.342.b07-0, 1.8.0-openjdk-devel-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-devel-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-accessibility-1.8.0.342.b07-0, 1.8.0-openjdk-accessibility-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-1.8.0.342.b07-0, 1.8.0-openjdk-src-1.8.0.342.b07-0, 1.8.0-openjdk-src-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-debugsource-1.8.0.342.b07-0, 1.8.0-openjdk-debuginfo-1.8.0.342.b07-0, 1.8.0-openjdk-demo-1.8.0.342.b07-0, 1.8.0-openjdk-demo-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-headless-1.8.0.342.b07-0, 1.8.0-openjdk-headless-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-javadoc-1.8.0.342.b07-0, 1.8.0-openjdk-javadoc-zip-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-1.8.0.342.b07-0, 1.8.0-openjdk-openjfx-slowdebug-1.8.0.342.b07-0, 1.8.0-openjdk-slowdebug-1.8.0.342.b07-0
java-1_8_0-ibm - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-devel-32bit - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-32bit - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-src - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-demo - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
eap8-aesh-extensions (Red Hat package) - addressed in versions 1.8.0-2.redhat_00001.1.el8eap, 1.8.0-2.redhat_00001.1.el9eap
java-1.8.0-openjdk - addressed in versions 1.8.0.342.b07-1, 1.8.0.342.b07-2
java-1.8.0-openjdk-demo - addressed in versions 1.8.0.342.b07-1, 1.8.0.342.b07-2
java-1.8.0-openjdk-demo-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-accessibility-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-accessibility - addressed in versions 1.8.0.342.b07-1, 1.8.0.342.b07-2
java-1.8.0-openjdk-devel - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-headless - addressed in versions 1.8.0.342.b07-1, 1.8.0.342.b07-2
java-1.8.0-openjdk-javadoc-zip-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-javadoc-zip - addressed in versions 1.8.0.342.b07-1, 1.8.0.342.b07-2
java-1.8.0-openjdk-javadoc-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-devel-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-javadoc - addressed in versions 1.8.0.342.b07-1, 1.8.0.342.b07-2
java-1.8.0-openjdk-src-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk-src - addressed in versions 1.8.0.342.b07-1, 1.8.0.342.b07-2
java-1.8.0-openjdk-headless-debug - update to 1.8.0.342.b07-1
java-1.8.0-openjdk (Red Hat package) - addressed in versions 1.8.0.342 b07-1.el7_9, 1.8.0.342 b07-1.el8_1, 1.8.0.342 b07-1.el8_2, 1.8.0.342 b07-1.el8_4, 1.8.0.342 b07-1.el9_0, 1.8.0.342 b07-2.el8_6
java-1.8.0-openjdk - addressed in versions 1.8.0.342.b07-1.fc35, 1.8.0.342.b07-1.fc36
java-1_8_0-openjdk-headless - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-debuginfo - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-debugsource - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-demo - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-demo-debuginfo - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-devel - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-devel-debuginfo - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-headless-debuginfo - addressed in versions 1.8.0.345-27.78.1, 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-javadoc - update to 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-accessibility - update to 1.8.0.345-150000.3.70.1
java-1_8_0-openjdk-src - update to 1.8.0.345-150000.3.70.1
java-1_8_0-openj9-accessibility - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-headless-debuginfo - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-headless - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-devel-debuginfo - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-devel - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-demo-debuginfo - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-demo - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-debugsource - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-debuginfo - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-javadoc - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9 - update to 1.8.0.345-150200.3.24.1
java-1_8_0-openj9-src - update to 1.8.0.345-150200.3.24.1
eap8-aws-java-sdk (Red Hat package) - addressed in versions 1.12.284-2.redhat_00002.1.el8eap, 1.12.284-2.redhat_00002.1.el9eap
eap7-jsoup (Red Hat package) - addressed in versions 1.15.4-1.redhat_00003.1.el7eap, 1.15.4-1.redhat_00003.1.el8eap, 1.15.4-1.redhat_00003.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.16.1-2.redhat_00007.1.el8eap, 1.16.1-2.redhat_00007.1.el9eap
Red Hat OpenShift Serverless - update to 1.24.0
eap7-bouncycastle (Red Hat package) - update to 1.68.0-1.redhat_00005.1.ep7.el7
eap8-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-activemq-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-artemis-wildfly-integration (Red Hat package) - addressed in versions 2.0.1-1.redhat_00002.1.el8eap, 2.0.1-1.redhat_00002.1.el9eap
eap8-resteasy-extensions (Red Hat package) - addressed in versions 2.0.1-3.Final_redhat_00001.1.el8eap, 2.0.1-3.Final_redhat_00001.1.el9eap
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.el8eap, 2.0.15-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.ep7.el7
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-1.redhat_00001.1.el8eap, 2.0.16-1.redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.0.91
eap8-fastinfoset (Red Hat package) - addressed in versions 2.1.0-4.redhat_00001.1.el8eap, 2.1.0-4.redhat_00001.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.2.0-1.redhat_00001.1.el8eap, 2.2.0-1.redhat_00001.1.el9eap
eap8-aesh-readline (Red Hat package) - addressed in versions 2.2.0-2.redhat_00001.1.el8eap, 2.2.0-2.redhat_00001.1.el9eap
eap7-xml-security (Red Hat package) - update to 2.2.3-2.redhat_00001.1.el7eap
eap8-pem-keystore (Red Hat package) - addressed in versions 2.3.0-1.redhat_00001.1.el8eap, 2.3.0-1.redhat_00001.1.el9eap
eap7-wss4j (Red Hat package) - update to 2.3.3-2.redhat_00001.1.el7eap
Cloud Pak for Network Automation - update to 2.6.4
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-26.redhat_00015.1.ep7.el7, 2.7.1-37.redhat_00015.1.el7eap, 2.7.1-37.redhat_00015.1.el8eap, 2.7.1-37.redhat_00015.1.el9eap, 2.7.1-38.redhat_00015.1.el7eap
eap7-jackson-databind (Red Hat package) - update to 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.15.1-1.redhat_00001.1.el8eap, 2.15.1-1.redhat_00001.1.el9eap
eap8-log4j (Red Hat package) - addressed in versions 2.22.1-1.redhat_00002.1.el8eap, 2.22.1-1.redhat_00002.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.33.0-1.redhat_00015.1.el8eap, 2.33.0-1.redhat_00015.1.el9eap
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package) - addressed in versions 3.0.1-1.redhat_00001.1.el8eap, 3.0.1-1.redhat_00001.1.el9eap
eap8-resteasy-spring (Red Hat package) - addressed in versions 3.0.1-2.Final_redhat_00001.1.el8eap, 3.0.1-2.Final_redhat_00001.1.el9eap
eap8-saaj-impl (Red Hat package) - addressed in versions 3.0.4-1.redhat_00001.1.el8eap, 3.0.4-1.redhat_00001.1.el9eap
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.3
eap7-apache-cxf (Red Hat package) - addressed in versions 3.1.16-3.SP1_redhat_00001.1.ep7.el7, 3.4.10-1.SP1_redhat_00001.1.el7eap
eap8-apache-commons-collections (Red Hat package) - addressed in versions 3.2.2-28.redhat_2.1.el8eap, 3.2.2-28.redhat_2.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.24-1.Final_redhat_00001.1.el7eap, 3.3.24-1.Final_redhat_00001.1.el8eap, 3.3.24-1.Final_redhat_00001.1.el9eap
PowerStore T - update to 3.5.0.1-2083289
eap8-jboss-logging (Red Hat package) - addressed in versions 3.5.3-1.Final_redhat_00001.1.el8eap, 3.5.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.5.10-1.Final_redhat_00001.1.ep7.el7, 3.7.13-1.Final_redhat_00001.1.el7eap
Red Hat Integration Camel Extensions for Quarkus - update to 3.8.4.SP2
eap8-apache-commons-lang (Red Hat package) - addressed in versions 3.14.0-2.redhat_00006.1.el8eap, 3.14.0-2.redhat_00006.1.el9eap
Red Hat Camel for Spring Boot - update to 3.20.6
eap8-jctools (Red Hat package) - addressed in versions 4.0.2-1.redhat_00001.1.el8eap, 4.0.2-1.redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.5-1.redhat_00001.1.el8eap, 4.0.5-1.redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.55-1.Final_redhat_00001.1.el7eap, 4.0.55-1.Final_redhat_00001.1.el8eap, 4.0.55-1.Final_redhat_00001.1.el9eap
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.8.0.0
DB2 on Cloud Pak for Data - update to 4.8.8
DB2 Warehouse on Cloud Pak for Data - update to 4.8.8
IBM DB2 - update to 5.0
eap8-jgroups (Red Hat package) - addressed in versions 5.3.10-1.Final_redhat_00001.1.el8eap, 5.3.10-1.Final_redhat_00001.1.el9eap
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.12-1.Final_redhat_00001.1.el7eap, 5.4.12-1.Final_redhat_00001.1.el8eap, 5.4.12-1.Final_redhat_00001.1.el9eap
IBM Sterling Secure Proxy - addressed in versions 6.0.3 iFix 11, 6.1.0 iFix 03
eap8-narayana (Red Hat package) - addressed in versions 6.0.3-1.Final_redhat_00001.1.el8eap, 6.0.3-1.Final_redhat_00001.1.el9eap
eap7-hibernate-validator (Red Hat package) - addressed in versions 6.0.23-2.SP1_redhat_00001.1.el7eap, 6.0.23-2.SP1_redhat_00001.1.el8eap, 6.0.23-2.SP1_redhat_00001.1.el9eap
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
bcel - update to 6.2-5
eap8-hibernate (Red Hat package) - addressed in versions 6.2.31-1.Final_redhat_00002.1.el8eap, 6.2.31-1.Final_redhat_00002.1.el9eap
bcel (Debian package) - update to 6.5.0-1+deb11u1
dev-java/bcel - update to 6.6.0
eap7-wildfly (Red Hat package) - addressed in versions 7.1.8-2.GA_redhat_00002.1.ep7.el7, 7.3.11-4.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el8eap, 7.4.19-1.GA_redhat_00002.1.el9eap
Tivoli Composite Application Manager for Transactions - update to 7.4.0.2.22
Dell EMC VxRail Appliance - update to 8.0.000
openjdk-8-jdk (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre-headless (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre-zero (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
eap8-shibboleth-java-support (Red Hat package) - addressed in versions 8.0.0-6.redhat_00001.1.el8eap, 8.0.0-6.redhat_00001.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-3.Final_redhat_00001.1.el8eap, 8.0.1-3.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.4-2.GA_redhat_00005.1.el8eap, 8.0.4-2.GA_redhat_00005.1.el9eap
IBM Semeru Runtimes - addressed in versions 8.0.345.0, 11.0.16.0, 17.0.4.0, 18.0.2.0
Maximo Application Suite - IoT Component - addressed in versions 8.7.15, 8.8.11, 9.0.1
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 39, 8.11.0.1 Interim fix 21, 8.11.1 Interim fix 9, 8.12.0 Interim fix 1
Solutions Enabler - update to 9.2.3.5
Solutions Enabler Virtual Appliance - update to 9.2.3.5
Unisphere 360 - update to 9.2.3.8
Unisphere for PowerMax - update to 9.2.3.20
Unisphere for PowerMax Virtual Appliance - update to 9.2.3.20
eVASA Provider Virtual Appliance - update to 9.2.4.11
VASA Provider Standalone - update to 9.2.4.21
eap8-objectweb-asm (Red Hat package) - addressed in versions 9.6.0-1.redhat_00002.1.el8eap, 9.6.0-1.redhat_00002.1.el9eap
eap8-nimbus-jose-jwt (Red Hat package) - addressed in versions 9.37.3-1.redhat_00001.1.el8eap, 9.37.3-1.redhat_00001.1.el9eap
IBM API Connect - addressed in versions 10.0.1.9, 10.0.5.1
IBM Security Verify Governance - update to 10.0.2
java-11-openjdk-headless - addressed in versions 11.0.16.0-3.46.1, 11.0.16.0-150000.3.83.1
java-11-openjdk-devel - addressed in versions 11.0.16.0-3.46.1, 11.0.16.0-150000.3.83.1
java-11-openjdk-demo - addressed in versions 11.0.16.0-3.46.1, 11.0.16.0-150000.3.83.1
java-11-openjdk-debugsource - addressed in versions 11.0.16.0-3.46.1, 11.0.16.0-150000.3.83.1
java-11-openjdk - addressed in versions 11.0.16.0-3.46.1, 11.0.16.0-150000.3.83.1
java-11-openjdk-javadoc - update to 11.0.16.0.8-1
java-11-openjdk-static-libs-debug - update to 11.0.16.0.8-1
java-11-openjdk-static-libs - update to 11.0.16.0.8-1
java-11-openjdk-src-debug - update to 11.0.16.0.8-1
java-11-openjdk-src - update to 11.0.16.0.8-1
java-11-openjdk-jmods-debug - update to 11.0.16.0.8-1
java-11-openjdk-javadoc-zip-debug - update to 11.0.16.0.8-1
java-11-openjdk-jmods - update to 11.0.16.0.8-1
java-11-openjdk-javadoc-zip - update to 11.0.16.0.8-1
java-11-openjdk - update to 11.0.16.0.8-1
java-11-openjdk-debug - update to 11.0.16.0.8-1
java-11-openjdk-demo - update to 11.0.16.0.8-1
java-11-openjdk-demo-debug - update to 11.0.16.0.8-1
java-11-openjdk-devel - update to 11.0.16.0.8-1
java-11-openjdk-devel-debug - update to 11.0.16.0.8-1
java-11-openjdk-headless - update to 11.0.16.0.8-1
java-11-openjdk-headless-debug - update to 11.0.16.0.8-1
java-11-openjdk-javadoc-debug - update to 11.0.16.0.8-1
java-11-openjdk - addressed in versions 11.0.16.0.8-1.fc35, 11.0.16.0.8-1.fc36
java-11-openjdk-accessibility-debuginfo - update to 11.0.16.0-150000.3.83.1
java-11-openjdk-accessibility - update to 11.0.16.0-150000.3.83.1
java-11-openjdk-jmods - update to 11.0.16.0-150000.3.83.1
java-11-openjdk-src - update to 11.0.16.0-150000.3.83.1
java-11-openjdk-javadoc - update to 11.0.16.0-150000.3.83.1
java-11-openjdk-demo - update to 11.0.16.8-0
java-11-openjdk-devel - update to 11.0.16.8-0
java-11-openjdk-headless-slowdebug - update to 11.0.16.8-0
java-11-openjdk-debuginfo - update to 11.0.16.8-0
java-11-openjdk-src - update to 11.0.16.8-0
java-11-openjdk-slowdebug - update to 11.0.16.8-0
java-11-openjdk-src-slowdebug - update to 11.0.16.8-0
java-11-openjdk-jmods-slowdebug - update to 11.0.16.8-0
java-11-openjdk-devel-slowdebug - update to 11.0.16.8-0
java-11-openjdk-jmods - update to 11.0.16.8-0
java-11-openjdk-demo-slowdebug - update to 11.0.16.8-0
java-11-openjdk-javadoc-zip - update to 11.0.16.8-0
java-11-openjdk-headless - update to 11.0.16.8-0
java-11-openjdk - update to 11.0.16.8-0
java-11-openjdk-javadoc - update to 11.0.16.8-0
java-11-openjdk-debugsource - update to 11.0.16.8-0
openjdk-11-jre (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jre-zero (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jdk (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jre-headless (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
Cognos Transformer - update to 11.1.7 Fix Pack 8
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
java-17-openjdk - addressed in versions 17.0.4.0.8-1.fc35, 17.0.4.0.8-1.fc36
java-17-openjdk-static-libs - update to 17.0.4.0.8-2
java-17-openjdk-src - update to 17.0.4.0.8-2
java-17-openjdk-jmods - update to 17.0.4.0.8-2
java-17-openjdk-javadoc-zip - update to 17.0.4.0.8-2
java-17-openjdk-javadoc - update to 17.0.4.0.8-2
java-17-openjdk - update to 17.0.4.0.8-2
java-17-openjdk-demo - update to 17.0.4.0.8-2
java-17-openjdk-devel - update to 17.0.4.0.8-2
java-17-openjdk-headless - update to 17.0.4.0.8-2
java-17-openjdk-accessibility-debuginfo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-devel - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-debuginfo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-debugsource - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-javadoc - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-demo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-src - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-jmods - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-headless-debuginfo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-headless - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-devel-debuginfo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-accessibility - update to 17.0.4.0-150400.3.3.1
openjdk-17-jdk (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jre-zero (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jre (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jre-headless (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
java-latest-openjdk - addressed in versions 18.0.2.0.9-1.rolling.fc35, 18.0.2.0.9-1.rolling.fc36
java-latest-openjdk-jmods - update to 18.0.2.9-0.rolling
java-latest-openjdk-debuginfo - update to 18.0.2.9-0.rolling
java-latest-openjdk-javadoc - update to 18.0.2.9-0.rolling
java-latest-openjdk-headless - update to 18.0.2.9-0.rolling
java-latest-openjdk-devel - update to 18.0.2.9-0.rolling
java-latest-openjdk-debugsource - update to 18.0.2.9-0.rolling
java-latest-openjdk-javadoc-zip - update to 18.0.2.9-0.rolling
java-latest-openjdk - update to 18.0.2.9-0.rolling
java-latest-openjdk-demo - update to 18.0.2.9-0.rolling
java-latest-openjdk-src - update to 18.0.2.9-0.rolling
openjdk-18-jre-zero (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jre (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jre-headless (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jdk (Ubuntu package) - update to 18.0.2+9-2~22.04
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.22, 22.0.2.6
IBM Robotic Process Automation - update to 21.0.5
IBM Business Automation Workflow - update to 23.0.2 IF003
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.4.0-1.GA_redhat_00001.1.el8eap, 800.4.0-1.GA_redhat_00001.1.el9eap

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins