PT-2022-2323 · Oracle+8 · Oracle Java Se+10

Neil Madden

·

Published

2021-10-20

·

Updated

2026-05-08

·

CVE-2022-21449

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u331, 8u321, 11.0.14, 17.0.2, 18 Oracle GraalVM Enterprise Edition versions 20.3.5, 21.3.1, 22.0.0.2
Description The issue is related to the implementation of the ECDSA digital signature algorithm in Oracle Java SE and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access via multiple protocols to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability can be exploited by using APIs in the specified component, and it applies to Java deployments that load and run untrusted code. The estimated number of potentially affected devices is not specified.
The vulnerability is caused by a flawed implementation of the ECDSA algorithm, which fails to check if the r and s values are zero. This allows an attacker to present a completely empty signature that will still be accepted as valid by the vulnerable implementation. Successful exploitation can lead to the bypass of signature validation, allowing an attacker to intercept and modify encrypted messages or bypass authentication in some cases.
Technical details about exploitation include the use of APIs in the specified component, such as through a web service that supplies data to the APIs. The checkPassword() function is not explicitly mentioned as vulnerable, but the issue is related to the validation of digital signatures.
Recommendations To resolve the issue for each affected version, update to the latest version of Java. Specifically:
  • For Java 17, update to 17.0.3
  • For Java 18, update to 18.0.1
  • For Java 7, update to 7u341
  • For Java 8, update to 8u331
  • For Java 11, update to 11.0.15 As a temporary workaround, consider restricting access to the vulnerable component until a patch is available. Avoid using the vulnerable API endpoints until the issue is resolved.

Exploit

Fix

Improper Verification of Cryptographic Signature

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2021_3891
ALSA-2021_3893
ALSA-2021_4135
ALSA-2022:1445
ALSA-2022_0161
ALSA-2022_0185
ALSA-2022_0307
ALSA-2022_1442
ALSA-2022_1445
ALSA-2022_1491
ALSA-2022_5683
ALSA-2022_5695
ALSA-2022_5696
ALSA-2022_5709
ALSA-2022_5736
BDU:2022-02516
BIT-JAVA-2022-21449
BIT-JAVA-MIN-2022-21449
BIT-JRE-2022-21449
CESA-2022_1445
CVE-2022-21449
DSA-5128-1
DSA-5131-1
ELSA-2022-1445
ELSA-2022-1729
OESA-2022-1702
OPENSUSE-SU-2022_2650-1
OPENSUSE-SU-2024:12014-1
OPENSUSE-SU-2024:12015-1
OPENSUSE-SU-2024:12019-1
RHSA-2022:1445
RHSA-2022:1729
RHSA-2022_1445
RHSA-2022_1729
RLSA-2022:1445
RLSA-2022_1445
SUSE-SU-2022:2539-1
SUSE-SU-2022:2540-1
SUSE-SU-2022:2650-1
SUSE-SU-2022_2539-1
SUSE-SU-2022_2540-1
SUSE-SU-2022_2650-1
USN-5388-2
USN-5546-1

Affected Products

Almalinux
Centos
Java Platform
Linuxmint
Oracle Graalvm Enterprise Edition
Oracle Java Se
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu