CVE-2022-21443

LOW

Published Apr 19, 20224y ago · Modified Jun 17, 20262w ago

3.7 CVSS 3.1

Low

Published Apr 19, 2022 4y ago

Last Modified Jun 17, 2026 2w ago

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS Details

Base Score

3.7

Exploitability

2.2

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability Low

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

Patch Available

Affected Products 33

Vendor	Product	Version	Range
oracle	graalvm	20.3.5	any
oracle	graalvm	21.3.1	any
oracle	graalvm	22.0.0.2	any
oracle	java_se	7u331	any
oracle	java_se	8u321	any
oracle	java_se	11.0.14	any
oracle	java_se	17.0.2	any
oracle	java_se	18	any
netapp	active_iq_unified_manager	*	any
netapp	active_iq_unified_manager	*	any
netapp	cloud_insights_acquisition_unit	*	any
netapp	cloud_secure_agent	*	any
netapp	e-series_santricity_os_controller	*	≥11.0.0 – ≤11.70.1
netapp	e-series_santricity_storage_manager	*	any
netapp	e-series_santricity_web_services	*	any
netapp	element_software	*	any
netapp	hci_management_node	*	any
netapp	oncommand_insight	*	any
netapp	santricity_unified_manager	*	any
netapp	solidfire	*	any
netapp	bootstrap_os	*	any
netapp	hci_compute_node	*	any
debian	debian_linux	9.0	any
debian	debian_linux	10.0	any
debian	debian_linux	11.0	any
azul	zulu	6.45	any
azul	zulu	7.52	any
azul	zulu	8.60	any
azul	zulu	11.54	any
azul	zulu	13.46	any
azul	zulu	15.38	any
azul	zulu	17.32	any
azul	zulu	18.28	any

References 6

lists.debian.org https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html

Mailing ListThird Party Advisory
security.netapp.com https://security.netapp.com/advisory/ntap-20220429-0006/

Third Party Advisory
security.netapp.com https://security.netapp.com/advisory/ntap-20240621-0006/
debian.org https://www.debian.org/security/2022/dsa-5128

Third Party Advisory
debian.org https://www.debian.org/security/2022/dsa-5131

Third Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html

PatchVendor Advisory

Remediation

oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html

PatchVendor Advisory