CVE-2023-22081
Summary
| CVE | CVE-2023-22081 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-10-17 22:15:00 UTC |
| Updated | 2023-11-08 05:15:00 UTC |
| Description | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Graalvm For Jdk | 17.0.8 | All | All | All |
| Application | Oracle | Graalvm For Jdk | 21 | All | All | All |
| Application | Oracle | Jdk | 1.8.0 | update381 | All | All |
| Application | Oracle | Jdk | 1.8.0 | update381 | All | All |
| Application | Oracle | Jdk | 11.0.2 | All | All | All |
| Application | Oracle | Jdk | 17.0.8 | All | All | All |
| Application | Oracle | Jdk | 21.0.0 | All | All | All |
| Application | Oracle | Jre | 1.8.0 | update381 | All | All |
| Application | Oracle | Jre | 1.8.0 | update381 | All | All |
| Application | Oracle | Jre | 11.0.2 | All | All | All |
| Application | Oracle | Jre | 17.0.8 | All | All | All |
| Application | Oracle | Jre | 21.0.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 3636-1] openjdk-11 security update | MISC | lists.debian.org | |
| Oracle Critical Patch Update Advisory - October 2023 | MISC | www.oracle.com | |
| October 2023 Java Platform Standard Edition Vulnerabilities in NetApp Products | NetApp Product Security | MISC | security.netapp.com | |
| Debian -- Security Information -- DSA-5537-1 openjdk-11 | MISC | www.debian.org | |
| Debian -- Security Information -- DSA-5548-1 openjdk-17 | MISC | www.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160999 Oracle Enterprise Linux Security Update for java-11-openjdk (ELSA-2023-5736)
- 161001 Oracle Enterprise Linux Security Update for java-1.8.0-openjdk (ELSA-2023-5761)
- 161026 Oracle Enterprise Linux Security Update for java-11-openjdk (ELSA-2023-5744)
- 161028 Oracle Enterprise Linux Security Update for java-11-openjdk (ELSA-2023-5742)
- 161031 Oracle Enterprise Linux Security Update for java-17-openjdk (ELSA-2023-5751)
- 161032 Oracle Enterprise Linux Security Update for java-17-openjdk (ELSA-2023-5753)
- 161040 Oracle Enterprise Linux Security Update for java-1.8.0-openjdk (ELSA-2023-5731)
- 161043 Oracle Enterprise Linux Security Update for java-1.8.0-openjdk (ELSA-2023-5733)
- 161121 Oracle Enterprise Linux Security Update for java-21-openjdk (ELSA-2023-6738)
- 161156 Oracle Enterprise Linux Security Update for java-21-openjdk (ELSA-2023-6887)
- 199964 Ubuntu Security Notification for Open Java Development Toolkit (OpenJDK) Vulnerabilities (USN-6527-1)
- 199967 Ubuntu Security Notification for Open Java Development Toolkit (OpenJDK) 8 Vulnerabilities (USN-6528-1)
- 242199 Red Hat Update for java-11-openjdk (RHSA-2023:5744)
- 242200 Red Hat Update for java-11-openjdk (RHSA-2023:5742)
- 242201 Red Hat Update for java-17-openjdk (RHSA-2023:5750)
- 242202 Red Hat Update for java-11-openjdk (RHSA-2023:5739)
- 242203 Red Hat Update for java-17-openjdk (RHSA-2023:5753)
- 242204 Red Hat Update for java-11-openjdk (RHSA-2023:5737)
- 242205 Red Hat Update for java-17-openjdk (RHSA-2023:5752)
- 242207 Red Hat Update for java-11-openjdk (RHSA-2023:5741)
- 242209 Red Hat Update for java-11-openjdk (RHSA-2023:5743)
- 242210 Red Hat Update for java-11-openjdk (RHSA-2023:5736)
- 242211 Red Hat Update for java-17-openjdk (RHSA-2023:5751)
- 242213 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5728)
- 242215 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5732)
- 242216 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5730)
- 242217 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5727)
- 242218 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5731)
- 242220 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5761)
- 242354 Red Hat Update for java-21-openjdk (RHSA-2023:6738)
- 242358 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5729)
- 242369 Red Hat Update for java-1.8.0-openjdk (RHSA-2023:5733)
- 242372 Red Hat Update for java-11-openjdk (RHSA-2023:5740)
- 242386 Red Hat Update for java-17-openjdk (RHSA-2023:5747)
- 242597 Red Hat Update for java-21-openjdk (RHSA-2023:6887)
- 242936 Red Hat Update for java-1.8.0-ibm (RHSA-2024:0866)
- 242937 Red Hat Update for java-1.8.0-ibm (RHSA-2024:0879)
- 257261 CentOS Security Update for java-11-openjdk
- 257263 Centos Security Update for java-1.8.0-openjdk
- 257277 CentOS Security Update for java-1.8.0-openjdk Security Update (CESA-2023:5761)
- 257285 CentOS Security Update for java-11-openjdk (CESA-2023:5736)
- 330157 IBM AIX Java Multiple Vulnerabilities (java_dec2023_advisory)
- 356429 Amazon Linux Security Advisory for java-11-amazon-corretto : ALAS2-2023-2315
- 356431 Amazon Linux Security Advisory for java-17-amazon-corretto : ALAS2-2023-2314
- 356527 Amazon Linux Security Advisory for java-17-amazon-corretto : ALAS2023-2023-400
- 356528 Amazon Linux Security Advisory for java-21-amazon-corretto : ALAS2023-2023-399
- 356533 Amazon Linux Security Advisory for java-1.8.0-amazon-corretto : ALAS2023-2023-398
- 356539 Amazon Linux Security Advisory for java-11-amazon-corretto : ALAS2023-2023-401
- 356596 Amazon Linux Security Advisory for java-1.8.0-amazon-corretto : ALAS2CORRETTO8-2023-008
- 356617 Amazon Linux Security Advisory for java-11-amazon-corretto : ALAS2023-2023-427
- 356633 Amazon Linux Security Advisory for java-1.8.0-amazon-corretto : ALAS2023-2023-426
- 378945 Oracle Java Standard Edition (SE) Critical Patch Update - October 2023 (CPUOCT2023)
- 378949 Azul Java Multiple Vulnerabilities Security Update October 2023
- 378950 Amazon Corretto Critical Patch Update (OCT2023)
- 379036 Alibaba Cloud Linux Security Update for java-11-openjdk (ALINUX2-SA-2023:0044)
- 379039 Alibaba Cloud Linux Security Update for java-1.8.0-openjdk (ALINUX2-SA-2023:0043)
- 379042 Alibaba Cloud Linux Security Update for java-1.8.0-openjdk (ALINUX3-SA-2023:0133)
- 379046 Alibaba Cloud Linux Security Update for java-11-openjdk (ALINUX3-SA-2023:0134)
- 379065 IBM Java Software Development Kit (SDK) Security Vulnerability (7078433)
- 379114 Alibaba Cloud Linux Security Update for java-17-openjdk (ALINUX3-SA-2023:0138)
- 379287 IBM MQ Vulnerabilities in IBM Runtime Environment (7096711)
- 379516 IBM Sterling Secure Proxy Multiple Vulnerabilities (7142038)
- 503426 Alpine Linux Security Update for openjdk11
- 503428 Alpine Linux Security Update for openjdk17
- 503482 Alpine Linux Security Update for openjdk8
- 506136 Alpine Linux Security Update for openjdk11
- 506138 Alpine Linux Security Update for openjdk17
- 506142 Alpine Linux Security Update for openjdk8
- 510682 Alpine Linux Security Update for openjdk21
- 6000283 Debian Security Update for openjdk-11 (DLA 3636-1)
- 6000304 Debian Security Update for openjdk-11 (DSA 5537-1)
- 6000309 Debian Security Update for openjdk-17 (DSA 5548-1)
- 755127 SUSE Enterprise Linux Security Update for java-11-openjdk (SUSE-SU-2023:4152-1)
- 755157 SUSE Enterprise Linux Security Update for java-11-openjdk (SUSE-SU-2023:4198-1)
- 755207 SUSE Enterprise Linux Security Update for java-17-openjdk (SUSE-SU-2023:4289-1)
- 755302 SUSE Enterprise Linux Security Update for java-1_8_0-openjdk (SUSE-SU-2023:4507-1)
- 755303 SUSE Enterprise Linux Security Update for java-1_8_0-openjdk (SUSE-SU-2023:4506-1)
- 941314 AlmaLinux Security Update for java-1.8.0-openjdk (ALSA-2023:5731)
- 941315 AlmaLinux Security Update for java-11-openjdk (ALSA-2023:5742)
- 941316 AlmaLinux Security Update for java-17-openjdk (ALSA-2023:5751)
- 941319 AlmaLinux Security Update for java-1.8.0-openjdk (ALSA-2023:5733)
- 941322 AlmaLinux Security Update for java-17-openjdk (ALSA-2023:5753)
- 941323 AlmaLinux Security Update for java-11-openjdk (ALSA-2023:5744)
- 941388 AlmaLinux Security Update for java-21-openjdk (ALSA-2023:6738)
- 941463 AlmaLinux Security Update for java-21-openjdk (ALSA-2023:6887)
- 961054 Rocky Linux Security Update for java-11-openjdk (RLSA-2023:5742)