PT-2022-2127 · Oracle+3 · Java Se+5

Published 2022-01-18 · Updated 2026-05-08 · CVE-2022-21349

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u321, 8u311 Oracle GraalVM Enterprise Edition versions 20.3.4, 21.3.0

Description The issue is related to a vulnerability in the 2D component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability can be easily exploited by an unauthenticated attacker with network access via multiple protocols, allowing them to compromise the system. Successful attacks can result in a partial denial of service (partial DOS) of Oracle Java SE and Oracle GraalVM Enterprise Edition. The vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited through APIs in the specified component, such as through a web service that supplies data to the APIs.

Recommendations For Oracle Java SE versions 7u321, 8u311, update to a version that contains a fix for this vulnerability. For Oracle GraalVM Enterprise Edition versions 20.3.4, 21.3.0, update to a version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the 2D component until a patch is available. Avoid using APIs in the specified component until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2022-7653

ALT-PU-2022-7655

BDU:2022-02001

BIT-JAVA-2022-21349

BIT-JAVA-MIN-2022-21349

BIT-JRE-2022-21349

CVE-2022-21349

DLA-2917-1

OESA-2022-1786

OPENSUSE-SU-2022:0873-1

OPENSUSE-SU-2022:1027-1

OPENSUSE-SU-2022_0873-1

OPENSUSE-SU-2022_1027-1

OPENSUSE-SU-2024:11895-1

ROSA-SA-2023-2315

SUSE-SU-2022:0871-1

SUSE-SU-2022:0873-1

SUSE-SU-2022:1025-1

SUSE-SU-2022:1026-1

SUSE-SU-2022:1027-1

SUSE-SU-2022:14926-1

SUSE-SU-2022:14927-1

SUSE-SU-2022_14927-1

Affected Products

Alt Linux

Graalvm Enterprise Edition

Java Platform

Java Se

Red Os

Suse

References · 87

• https://nvd.nist.gov/vuln/detail/CVE-2022-34169 · Security Note
• https://osv.dev/vulnerability/BIT-java-min-2022-21349 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0873-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202209-05 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:14927-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:14926-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21349 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21349 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21540 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1786 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-java-2022-21349 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21349 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21349 · Vendor Advisory