PT-2023-13790 · Oracle+5 · Oracle Jdk+5
Published
2023-01-28
·
Updated
2024-02-17
·
CVE-2022-40433
CVSS v3.1
4.9
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Oracle JDK (HotSpot VM) versions 11 through 17
OpenJDK (HotSpot VM) versions 8 through 17
Description
An issue was discovered in the function
ciMethodBlocks::make block at, allowing attackers to cause a denial of service. The vendor states that this is considered Defense in Depth at most due to the nature of the issue and the special circumstances required, such as the server running particular code locally and code compiled with an old version of javac.Recommendations
For Oracle JDK (HotSpot VM) versions 11 through 17, consider disabling the
ciMethodBlocks::make block at function until a patch is available.
For OpenJDK (HotSpot VM) versions 8 through 17, restrict access to the ciMethodBlocks::make block at function to minimize the risk of exploitation.
However, since the CVE ID has been rejected by its CNA as it was not a security issue, no further action is required. At the moment, there is no information about a newer version that contains a fix for this issue, but given the rejection, no fix is expected.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Linuxmint
Oracle Jdk
Red Hat
Ubuntu