Input validation error in openjdk - CVE-2022-40433

Vulnerability identifier: #VU82255

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40433

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in within the ciMethodBlocks::make_block_at() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

openjdk
Amazon Linux AMI
Oracle Linux
Anolis OS
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Ubuntu
openEuler
IBM Cloud Pak for Watson AIOps
Red Hat Migration Toolkit for Applications
OpenJDK Java (for Middleware)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openjdk-8-jre-headless (Ubuntu package)
openjdk-8-jdk-headless (Ubuntu package)
openjdk-8-jdk (Ubuntu package)
openjdk-8-jre (Ubuntu package)
openjdk-8-jre-zero (Ubuntu package)
openjdk-8-jre-jamvm (Ubuntu package)
java
java-1.8.0-openjdk (Red Hat package)
java-1.8.0-openjdk-javadoc-zip
java-1.8.0-openjdk-javadoc
java-1.8.0-openjdk-src
java-1.8.0-openjdk-headless
java-1.8.0-openjdk-devel
java-1.8.0-openjdk-demo
java-1.8.0-openjdk-accessibility
java-1.8.0-openjdk
java-11-openjdk-devel-slowdebug
java-11-openjdk-demo-slowdebug
java-11-openjdk-demo
java-11-openjdk-javadoc
java-11-openjdk-slowdebug
java-11-openjdk-jmods-slowdebug
java-11-openjdk-headless
java-11-openjdk
java-11-openjdk-devel
java-11-openjdk-src-slowdebug
java-11-openjdk-src
java-11-openjdk-headless-slowdebug
java-11-openjdk-debugsource
java-11-openjdk-javadoc-zip
java-11-openjdk-debuginfo
java-11-openjdk-jmods
java-latest-openjdk-src
java-latest-openjdk-jmods
java-latest-openjdk-javadoc-zip
java-latest-openjdk-demo
java-latest-openjdk
java-latest-openjdk-javadoc
java-latest-openjdk-devel
java-latest-openjdk-headless

Install updates from vendor's website.

Red Hat Migration Toolkit for Applications - update to 6.1.4
OpenJDK Java (for Middleware) - update to 8.0.392
openjdk-8-jre-headless (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8u392-ga-1~20.04, 8u392-ga-1~22.04, 8u392-ga-1~23.04, 8u392-ga-1~23.10
openjdk-8-jdk-headless (Ubuntu package) - addressed in versions Ubuntu Pro, 8u392-ga-1~20.04, 8u392-ga-1~22.04, 8u392-ga-1~23.04, 8u392-ga-1~23.10
openjdk-8-jdk (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8u392-ga-1~20.04, 8u392-ga-1~22.04, 8u392-ga-1~23.04, 8u392-ga-1~23.10
openjdk-8-jre (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8u392-ga-1~20.04, 8u392-ga-1~22.04, 8u392-ga-1~23.04, 8u392-ga-1~23.10
openjdk-8-jre-zero (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8u392-ga-1~20.04, 8u392-ga-1~22.04, 8u392-ga-1~23.04, 8u392-ga-1~23.10
openjdk-8-jre-jamvm (Ubuntu package) - update to Ubuntu Pro
java - addressed in versions 1.8.0-openjdk-devel-1.8.0.382.b05-7, 1.8.0-openjdk-devel-1.8.0.382.b05-8, 1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-accessibility-1.8.0.382.b05-7, 1.8.0-openjdk-accessibility-1.8.0.382.b05-8, 1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-1.8.0.382.b05-7, 1.8.0-openjdk-1.8.0.382.b05-8, 1.8.0-openjdk-src-1.8.0.382.b05-7, 1.8.0-openjdk-src-1.8.0.382.b05-8, 1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-debuginfo-1.8.0.382.b05-7, 1.8.0-openjdk-debugsource-1.8.0.382.b05-7, 1.8.0-openjdk-debugsource-1.8.0.382.b05-8, 1.8.0-openjdk-debuginfo-1.8.0.382.b05-8, 1.8.0-openjdk-demo-1.8.0.382.b05-7, 1.8.0-openjdk-demo-1.8.0.382.b05-8, 1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-headless-1.8.0.382.b05-7, 1.8.0-openjdk-headless-1.8.0.382.b05-8, 1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-javadoc-1.8.0.382.b05-7, 1.8.0-openjdk-javadoc-1.8.0.382.b05-8, 1.8.0-openjdk-javadoc-zip-1.8.0.382.b05-7, 1.8.0-openjdk-javadoc-zip-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-1.8.0.382.b05-8, 1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-8, 1.8.0-openjdk-slowdebug-1.8.0.382.b05-7, 1.8.0-openjdk-slowdebug-1.8.0.382.b05-8
java-1.8.0-openjdk (Red Hat package) - addressed in versions 1.8.0.392.b08-2.el8_1, 1.8.0.392.b08-2.el8_2, 1.8.0.392.b08-2.el8_4, 1.8.0.392.b08-2.el8_6, 1.8.0.392.b08-2.el9_0, 1.8.0.392.b08-3.el9, 1.8.0.392.b08-4.el8
java-1.8.0-openjdk-javadoc-zip - update to 1.8.0.392.b08-4.0.2
java-1.8.0-openjdk-javadoc - update to 1.8.0.392.b08-4.0.2
java-1.8.0-openjdk-src - update to 1.8.0.392.b08-4.0.2
java-1.8.0-openjdk-headless - update to 1.8.0.392.b08-4.0.2
java-1.8.0-openjdk-devel - update to 1.8.0.392.b08-4.0.2
java-1.8.0-openjdk-demo - update to 1.8.0.392.b08-4.0.2
java-1.8.0-openjdk-accessibility - update to 1.8.0.392.b08-4.0.2
java-1.8.0-openjdk - update to 1.8.0.392.b08-4.0.2
java-11-openjdk-devel-slowdebug - update to 11.0.20.8-2
java-11-openjdk-demo-slowdebug - update to 11.0.20.8-2
java-11-openjdk-demo - update to 11.0.20.8-2
java-11-openjdk-javadoc - update to 11.0.20.8-2
java-11-openjdk-slowdebug - update to 11.0.20.8-2
java-11-openjdk-jmods-slowdebug - update to 11.0.20.8-2
java-11-openjdk-headless - update to 11.0.20.8-2
java-11-openjdk - update to 11.0.20.8-2
java-11-openjdk-devel - update to 11.0.20.8-2
java-11-openjdk-src-slowdebug - update to 11.0.20.8-2
java-11-openjdk-src - update to 11.0.20.8-2
java-11-openjdk-headless-slowdebug - update to 11.0.20.8-2
java-11-openjdk-debugsource - update to 11.0.20.8-2
java-11-openjdk-javadoc-zip - update to 11.0.20.8-2
java-11-openjdk-debuginfo - update to 11.0.20.8-2
java-11-openjdk-jmods - update to 11.0.20.8-2
java-latest-openjdk-src - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-jmods - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-javadoc-zip - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-demo - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-javadoc - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-devel - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling
java-latest-openjdk-headless - addressed in versions 20.0.2.9-1.rolling, 20.0.2.9-2.rolling

• https://github.com/openjdk/jdk15u-dev/pull/261
• https://github.com/openjdk/jdk13u-dev/pull/394
• https://bugs.openjdk.org/browse/JDK-8283441
• https://github.com/openjdk/jdk11u-dev/pull/1183

• Denial of service in Oracle OpenJDK
• Red Hat Enterprise Linux 9 update for java-1.8.0-openjdk
• Red Hat Enterprise Linux 9.0 Extended Update Support update for java-1.8.0-openjdk
• Red Hat Enterprise Linux 8 update for java-1.8.0-openjdk
• Red Hat Enterprise Linux 8.6 Extended Update Support update for java-1.8.0-openjdk
• Red Hat Enterprise Linux 8 update for java-1.8.0-openjdk
• Red Hat Enterprise Linux 8 update for java-1.8.0-openjdk
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for java-1.8.0-openjdk
• Red Hat OpenJDK 8 update for portable Linux builds
• Amazon Linux AMI update for java-1.8.0-openjdk
• Multiple vulnerabilities in Migration Toolkit for Applications 6.1
• Multiple vulnerabilities in Oracle Linux
• Ubuntu update for openjdk-8
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• openEuler 20.03 LTS SP3 update for openjdk-latest
• openEuler 22.03 LTS update for openjdk-latest
• openEuler 22.03 LTS SP1 update for openjdk-latest
• openEuler 22.03 LTS SP2 update for openjdk-latest
• openEuler 22.03 LTS SP1 update for openjdk-11
• openEuler 22.03 LTS SP2 update for openjdk-11
• openEuler 20.03 LTS SP1 update for openjdk-1.8.0
• openEuler 20.03 LTS SP3 update for openjdk-1.8.0
• openEuler 22.03 LTS update for openjdk-1.8.0
• openEuler 22.03 LTS SP1 update for openjdk-1.8.0
• openEuler 22.03 LTS SP2 update for openjdk-1.8.0
• openEuler 20.03 LTS SP1 update for openjdk-latest
• openEuler 20.03 LTS SP1 update for openjdk-11
• openEuler 20.03 LTS SP3 update for openjdk-11
• openEuler 22.03 LTS update for openjdk-11
• Amazon Linux AMI update for java-11-amazon-corretto
• Amazon Linux AMI update for java-1.8.0-amazon-corretto
• Anolis OS update for java-1.8.0-openjdk