PT-2023-4053 · Oracle+8 · Graalvm For Jdk+11

Motoyasu Saburi

·

Publicado

2023-07-18

·

Atualizado

2026-05-08

·

CVE-2023-22006

CVSS v3.1

3.1

Baixa

VetorAV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 11.0.19, 17.0.7, 20.0.1 Oracle GraalVM Enterprise Edition versions 20.3.10, 21.3.6, 22.3.2 Oracle GraalVM for JDK versions 17.0.7, 20.0.1
Description The issue is related to the Networking component of the affected software, allowing an unauthenticated attacker with network access via multiple protocols to compromise the system. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some accessible data. This vulnerability applies to Java deployments in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code and rely on the Java sandbox for security.
Recommendations For Oracle Java SE version 11.0.19, update to a newer version to mitigate the risk. For Oracle Java SE version 17.0.7, update to a newer version to mitigate the risk. For Oracle Java SE version 20.0.1, update to a newer version to mitigate the risk. For Oracle GraalVM Enterprise Edition version 20.3.10, update to a newer version to mitigate the risk. For Oracle GraalVM Enterprise Edition version 21.3.6, update to a newer version to mitigate the risk. For Oracle GraalVM Enterprise Edition version 22.3.2, update to a newer version to mitigate the risk. For Oracle GraalVM for JDK version 17.0.7, update to a newer version to mitigate the risk. For Oracle GraalVM for JDK version 20.0.1, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the Networking component until a patch is available.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALSA-2023:4158
ALSA-2023:4159
ALSA-2023:4175
ALSA-2023:4177
ALT-PU-2023-8475
ALT-PU-2023-8476
ALT-PU-2023-8478
ALT-PU-2023-8479
ALT-PU-2023-8480
ALT-PU-2023-8481
ALT-PU-2024-17585
ALT-PU-2024-17593
BDU:2023-04351
BIT-JAVA-2023-22006
BIT-JAVA-MIN-2023-22006
BIT-JRE-2023-22006
CESA-2023_4159
CESA-2023_4175
CVE-2023-22006
DLA-3571-1
DSA-5458-1
DSA-5478-1
MGASA-2023-0272
OESA-2023-1600
OESA-2023-1601
OESA-2023-1602
OESA-2023-1603
OESA-2023-1617
OESA-2023-1618
OESA-2023-1650
OESA-2023-1737
OESA-2023-1738
OESA-2023-1739
OPENSUSE-SU-2023_3023-1
OPENSUSE-SU-2023_3287-1
OPENSUSE-SU-2023_3441-1
OPENSUSE-SU-2024:13075-1
OPENSUSE-SU-2024:13076-1
OPENSUSE-SU-2024:13130-1
OPENSUSE-SU-2024:13131-1
OPENSUSE-SU-2025:0066-1
OPENSUSE-SU-2025:0067-1
RHSA-2023:4157
RHSA-2023:4158
RHSA-2023:4159
RHSA-2023:4162
RHSA-2023:4163
RHSA-2023:4164
RHSA-2023:4165
RHSA-2023:4169
RHSA-2023:4170
RHSA-2023:4171
RHSA-2023:4175
RHSA-2023:4177
RHSA-2023:4233
RHSA-2023_4158
RHSA-2023_4159
RHSA-2023_4175
RHSA-2023_4177
RHSA-2023_4233
SUSE-SU-2023:2990-1
SUSE-SU-2023:3023-1
SUSE-SU-2023:3287-1
SUSE-SU-2023:3406-1
SUSE-SU-2023:3441-1
SUSE-SU-2023_2990-1
SUSE-SU-2023_3023-1
SUSE-SU-2023_3287-1
USN-6263-1
USN-6263-2
USN-6272-1

Produtos afetados

Alt Linux
Almalinux
Astra Linux
Centos
Graalvm Enterprise Edition
Graalvm For Jdk
Java Platform
Java Se
Linuxmint
Red Hat
Suse
Ubuntu