PT-2023-3938 · Oracle · Graalvm For Jdk+1

Published 2023-07-18 · Updated 2023-07-27 · CVE-2023-22051

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle GraalVM Enterprise Edition versions 21.3.6, 22.3.2 Oracle GraalVM for JDK versions 17.0.7, 20.0.1

Description The issue is related to errors in processing input data in the GraalVM Compiler component of Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK. It allows an unauthenticated attacker with network access via multiple protocols to compromise the system, resulting in unauthorized read access to a subset of accessible data.

Recommendations For Oracle GraalVM Enterprise Edition version 21.3.6, update to a newer version to mitigate the risk. For Oracle GraalVM Enterprise Edition version 22.3.2, update to a newer version to mitigate the risk. For Oracle GraalVM for JDK version 17.0.7, update to a newer version to mitigate the risk. For Oracle GraalVM for JDK version 20.0.1, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the GraalVM Compiler component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04233

CVE-2023-22051

Affected Products

Graalvm Enterprise Edition

Graalvm For Jdk

References · 9

• https://osv.dev/vulnerability/CVE-2023-22051 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2023.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22051 · Security Note
• https://bdu.fstec.ru/vul/2023-04233 · Security Note
• https://cdn.azul.com/zulu/bin/zulu11.66.15-ca-jdk11.0.20-linux.x86_64.rpm · Note
• https://cybersecurity-help.cz/vdb/SB2023071985 · Note
• https://t.me/cvenotify/55363 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023071986 · Note
• https://vuldb.com/?id.234887 · Note