CVE-2023-22067
Summary
| CVE | CVE-2023-22067 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-10-17 22:15:00 UTC |
| Updated | 2024-02-01 02:09:00 UTC |
| Description | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Netapp | Cloud Insights Acquisition Unit | - | All | All | All |
| Application | Netapp | Cloud Insights Storage Workload Security Agent | - | All | All | All |
| Application | Oracle | Jdk | 1.8.0 | update381 | All | All |
| Application | Oracle | Jdk | 1.8.0 | update381 | All | All |
| Application | Oracle | Jre | 1.8.0 | update381 | All | All |
| Application | Oracle | Jre | 1.8.0 | update381 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Oracle Critical Patch Update Advisory - October 2023 | MISC | www.oracle.com | |
| October 2023 Java Platform Standard Edition Vulnerabilities in NetApp Products | NetApp Product Security | MISC | security.netapp.com | |
| Debian -- Security Information -- DSA-5537-1 openjdk-11 | MISC | www.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161001 Oracle Enterprise Linux Security Update for java-1.8.0-openjdk (ELSA-2023-5761)
- 161040 Oracle Enterprise Linux Security Update for java-1.8.0-openjdk (ELSA-2023-5731)
- 161043 Oracle Enterprise Linux Security Update for java-1.8.0-openjdk (ELSA-2023-5733)
- 199967 Ubuntu Security Notification for Open Java Development Toolkit (OpenJDK) 8 Vulnerabilities (USN-6528-1)
- 242213 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5728)
- 242215 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5732)
- 242216 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5730)
- 242217 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5727)
- 242218 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5731)
- 242220 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5761)
- 242358 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5729)
- 242369 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5733)
- 242937 Red Hat Update for java-1.8.0-ibm (RHSA-2024:0879)
- 257263 Centos Security Update for java-1.8.0-openjdk
- 257277 CentOS Security Update for java-1.8.0-openjdk Security Update (CESA-2023:5761)
- 296105 Oracle Solaris 11.4 Support Repository Update (SRU) 63.157.1 Missing (CPUOCT2023)
- 330157 IBM AIX Java Multiple Vulnerabilities (java_dec2023_advisory)
- 356533 Amazon Linux Security Advisory for java-1.8.0-amazon-corretto : ALAS2023-2023-398
- 356596 Amazon Linux Security Advisory for java-1.8.0-amazon-corretto : ALAS2CORRETTO8-2023-008
- 356633 Amazon Linux Security Advisory for java-1.8.0-amazon-corretto : ALAS2023-2023-426
- 378945 Oracle Java Standard Edition (SE) Critical Patch Update - October 2023 (CPUOCT2023)
- 378949 Azul Java Multiple Vulnerabilities Security Update October 2023
- 378950 Amazon Corretto Critical Patch Update (OCT2023)
- 379039 Alibaba Cloud Linux Security Update for java-1.8.0-openjdk (ALINUX2-SA-2023:0043)
- 379042 Alibaba Cloud Linux Security Update for java-1.8.0-openjdk (ALINUX3-SA-2023:0133)
- 379065 IBM Java Software Development Kit (SDK) Security Vulnerability (7078433)
- 379516 IBM Sterling Secure Proxy Multiple Vulnerabilities (7142038)
- 503482 Alpine Linux Security Update for openjdk8
- 506142 Alpine Linux Security Update for openjdk8
- 6000304 Debian Security Update for openjdk-11 (DSA 5537-1)
- 941314 AlmaLinux Security Update for java-1.8.0-openjdk (ALSA-2023:5731)
- 941319 AlmaLinux Security Update for java-1.8.0-openjdk (ALSA-2023:5733)