Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2022-21549

Vulnerability identifier: #VU65498

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21549

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Oracle GraalVM Enterprise Edition
Red Hat OpenShift Serverless
Solutions Enabler Virtual Appliance
SecurID Governance and Lifecycle
z/Transaction Processing Facility ( z/TPF)
IBM Cloud Object Storage Systems
RSA Identity Governance and Lifecycle
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
Fedora
API Manager
API Gateway
IBM Cloud Pak for Multicloud Management
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openjdk-17 (debian package)
java-17-openjdk (Red Hat package)
java-1_7_1-ibm-devel
java-1_7_1-ibm-alsa
java-1_7_1-ibm
java-1_7_1-ibm-jdbc
java-1_7_1-ibm-plugin
java
java-1_8_0-ibm-alsa
java-1_8_0-ibm-devel
java-1_8_0-ibm
java-1_8_0-ibm-plugin
java-1_8_0-ibm-devel-32bit
java-1_8_0-ibm-src
java-1_8_0-ibm-demo
java-1_8_0-ibm-32bit
openjdk-8-jre-zero (Ubuntu package)
openjdk-8-jre (Ubuntu package)
openjdk-8-jre-headless (Ubuntu package)
openjdk-8-jdk (Ubuntu package)
openjdk-11-jdk (Ubuntu package)
openjdk-11-jre-headless (Ubuntu package)
openjdk-11-jre (Ubuntu package)
openjdk-11-jre-zero (Ubuntu package)
java-17-openjdk
java-17-openjdk-jmods
java-17-openjdk-demo
java-17-openjdk-devel
java-17-openjdk-headless
java-17-openjdk-javadoc
java-17-openjdk-javadoc-zip
java-17-openjdk-src
java-17-openjdk-static-libs
java-17-openjdk-debugsource
java-17-openjdk-accessibility
java-17-openjdk-accessibility-debuginfo
java-17-openjdk-devel-debuginfo
java-17-openjdk-headless-debuginfo
java-17-openjdk-debuginfo
openjdk-17-jre-headless (Ubuntu package)
openjdk-17-jre (Ubuntu package)
openjdk-17-jdk (Ubuntu package)
openjdk-17-jre-zero (Ubuntu package)
openjdk-18-jre (Ubuntu package)
openjdk-18-jre-headless (Ubuntu package)
openjdk-18-jdk (Ubuntu package)
openjdk-18-jre-zero (Ubuntu package)
java-latest-openjdk-javadoc-zip
java-latest-openjdk
java-latest-openjdk-devel
java-latest-openjdk-demo
java-latest-openjdk-jmods
java-latest-openjdk-headless
java-latest-openjdk-src
java-latest-openjdk-javadoc
OpenJDK Java (for Middleware)
Oracle Java SE
IBM Semeru Runtimes
Solutions Enabler
Unisphere 360
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
eVASA Provider Virtual Appliance
VASA Provider Standalone
CloudBoost Virtual Appliance

Install updates from vendor's website.

API Manager - update to August 2022
API Gateway - update to August 2022
IBM Cloud Pak for Multicloud Management - update to 2.3.8
OpenJDK Java (for Middleware) - update to 17.0.4
openjdk-17 (debian package) - update to 17.0.4+8-1~deb11u1
java-17-openjdk (Red Hat package) - addressed in versions 17.0.4.0.8-2.el8_6, 17.0.4.0.8-2.el9_0
java-1_7_1-ibm-devel - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm-alsa - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm-jdbc - update to 1.7.1_sr5.15-38.74.1
java-1_7_1-ibm-plugin - update to 1.7.1_sr5.15-38.74.1
java - addressed in versions 1.8.0-openjdk-devel-1.8.0.382.b05-7, 1.8.0-openjdk-devel-1.8.0.382.b05-8, 1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-accessibility-1.8.0.382.b05-7, 1.8.0-openjdk-accessibility-1.8.0.382.b05-8, 1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-1.8.0.382.b05-7, 1.8.0-openjdk-1.8.0.382.b05-8, 1.8.0-openjdk-src-1.8.0.382.b05-7, 1.8.0-openjdk-src-1.8.0.382.b05-8, 1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-debugsource-1.8.0.382.b05-7, 1.8.0-openjdk-debuginfo-1.8.0.382.b05-7, 1.8.0-openjdk-debugsource-1.8.0.382.b05-8, 1.8.0-openjdk-debuginfo-1.8.0.382.b05-8, 1.8.0-openjdk-demo-1.8.0.382.b05-7, 1.8.0-openjdk-demo-1.8.0.382.b05-8, 1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-headless-1.8.0.382.b05-7, 1.8.0-openjdk-headless-1.8.0.382.b05-8, 1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-javadoc-1.8.0.382.b05-7, 1.8.0-openjdk-javadoc-1.8.0.382.b05-8, 1.8.0-openjdk-javadoc-zip-1.8.0.382.b05-7, 1.8.0-openjdk-javadoc-zip-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-slowdebug-1.8.0.382.b05-8
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr7.11-30.93.1, 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.15-30.96.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-devel-32bit - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-src - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-demo - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
java-1_8_0-ibm-32bit - addressed in versions 1.8.0_sr7.11-150000.3.62.1, 1.8.0_sr7.20-150000.3.65.1
Red Hat OpenShift Serverless - update to 1.24.0
openjdk-8-jre-zero (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jre-headless (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
openjdk-8-jdk (Ubuntu package) - addressed in versions 8u342b070ubuntu1~16.04, 8u342-b07-0ubuntu1~18.04, 8u342-b07-0ubuntu1~20.04, 8u342-b07-0ubuntu1~22.04
IBM Semeru Runtimes - addressed in versions 8.0.345.0, 11.0.16.0, 17.0.4.0, 18.0.2.0
Solutions Enabler - update to 9.2.3.5
Solutions Enabler Virtual Appliance - update to 9.2.3.5
Unisphere 360 - update to 9.2.3.8
Unisphere for PowerMax - update to 9.2.3.20
Unisphere for PowerMax Virtual Appliance - update to 9.2.3.20
eVASA Provider Virtual Appliance - update to 9.2.4.11
VASA Provider Standalone - update to 9.2.4.21
openjdk-11-jdk (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jre-headless (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jre (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
openjdk-11-jre-zero (Ubuntu package) - addressed in versions 11.0.16+8-0ubuntu1~18.04, 11.0.16+8-0ubuntu1~20.04, 11.0.16+8-0ubuntu1~22.04
java-17-openjdk - addressed in versions 17.0.4.0.8-1.fc35, 17.0.4.0.8-1.fc36
java-17-openjdk-jmods - update to 17.0.4.0.8-2
java-17-openjdk-demo - update to 17.0.4.0.8-2
java-17-openjdk-devel - update to 17.0.4.0.8-2
java-17-openjdk-headless - update to 17.0.4.0.8-2
java-17-openjdk-javadoc - update to 17.0.4.0.8-2
java-17-openjdk-javadoc-zip - update to 17.0.4.0.8-2
java-17-openjdk - update to 17.0.4.0.8-2
java-17-openjdk-src - update to 17.0.4.0.8-2
java-17-openjdk-static-libs - update to 17.0.4.0.8-2
java-17-openjdk-debugsource - update to 17.0.4.0-150400.3.3.1
java-17-openjdk - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-accessibility - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-accessibility-debuginfo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-demo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-devel - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-devel-debuginfo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-headless - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-headless-debuginfo - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-jmods - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-src - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-javadoc - update to 17.0.4.0-150400.3.3.1
java-17-openjdk-debuginfo - update to 17.0.4.0-150400.3.3.1
openjdk-17-jre-headless (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jre (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jdk (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-17-jre-zero (Ubuntu package) - addressed in versions 17.0.4+8-1~18.04, 17.0.4+8-1~20.04, 17.0.4+8-1~22.04
openjdk-18-jre (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jre-headless (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jdk (Ubuntu package) - update to 18.0.2+9-2~22.04
openjdk-18-jre-zero (Ubuntu package) - update to 18.0.2+9-2~22.04
CloudBoost Virtual Appliance - update to 19.12.0.1
java-latest-openjdk-javadoc-zip - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-devel - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-demo - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-jmods - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-headless - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-src - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-javadoc - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling

• https://www.oracle.com/security-alerts/cpujul2022.html

• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in Oracle Java SE
• Debian update for openjdk-17
• Red Hat Enterprise Linux 9 update for java-17-openjdk
• Multiple vulnerabilities in OpenJDK 17 Java (for Middleware)
• SUSE update for java-17-openjdk
• Ubuntu update for openjdk-8
• Ubuntu update for openjdk-17
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in IBM Cloud Object Storage Systems (OpenJDK)
• SUSE update for java-1_7_1-ibm
• SUSE update for java-1_8_0-ibm
• SUSE update for java-1_8_0-ibm
• SUSE update for java-1_8_0-ibm
• Multiple vulnerabilities in IBM z/Transaction Processing Facility ( z/TPF)
• Multiple vulnerabilities in IBM Semeru Runtime
• Multiple vulnerabilities in Dell products
• SUSE update for java-1_8_0-ibm
• Red Hat Enterprise Linux 8 update for java-17-openjdk
• Multiple vulnerabilities in API Gateway and API Manager
• Gentoo update for OpenJDK
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• openEuler 20.03 LTS SP3 update for openjdk-latest
• openEuler 22.03 LTS update for openjdk-latest
• openEuler 22.03 LTS SP1 update for openjdk-latest
• openEuler 22.03 LTS SP2 update for openjdk-latest
• openEuler 20.03 LTS SP1 update for openjdk-1.8.0
• openEuler 20.03 LTS SP3 update for openjdk-1.8.0
• openEuler 22.03 LTS update for openjdk-1.8.0
• openEuler 22.03 LTS SP1 update for openjdk-1.8.0
• openEuler 22.03 LTS SP2 update for openjdk-1.8.0
• openEuler 20.03 LTS SP1 update for openjdk-latest
• Fedora 36 update for java-17-openjdk
• Fedora 35 update for java-17-openjdk
• Anolis OS update for java-17-openjdk
• Dell CloudBoost Virtual Appliance update for third-party components
• RSA Governance and Lifecycle update for Oracle Databse