PT-2023-4050 · Oracle+9 · Graalvm For Jdk+12

David Stancu

·

Published

2023-07-18

·

Updated

2026-05-08

·

CVE-2023-22041

CVSS v3.1

5.1

Medium

VectorAV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u371-perf, 11.0.19, 17.0.7, 20.0.1 Oracle GraalVM Enterprise Edition versions 20.3.10, 21.3.6, 22.3.2 Oracle GraalVM for JDK versions 17.0.7, 20.0.1
Description The issue is related to a difficult to exploit vulnerability in the Hotspot component of Oracle Java SE, Oracle GraalVM Enterprise Edition, and Oracle GraalVM for JDK. This vulnerability allows an unauthenticated attacker with logon to the infrastructure where these products execute to compromise them. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data. The vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security.
Recommendations For Oracle Java SE version 8u371-perf, update to a fixed version when available. For Oracle Java SE version 11.0.19, update to a fixed version when available. For Oracle Java SE version 17.0.7, update to a fixed version when available. For Oracle Java SE version 20.0.1, update to a fixed version when available. For Oracle GraalVM Enterprise Edition version 20.3.10, update to a fixed version when available. For Oracle GraalVM Enterprise Edition version 21.3.6, update to a fixed version when available. For Oracle GraalVM Enterprise Edition version 22.3.2, update to a fixed version when available. For Oracle GraalVM for JDK version 17.0.7, update to a fixed version when available. For Oracle GraalVM for JDK version 20.0.1, update to a fixed version when available. As a temporary workaround, consider restricting access to untrusted code and sandboxed applications until a patch is available.

Exploit

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2023:4158
ALSA-2023:4159
ALSA-2023:4175
ALSA-2023:4177
ALT-PU-2023-8475
ALT-PU-2023-8476
ALT-PU-2023-8478
ALT-PU-2023-8479
ALT-PU-2023-8480
ALT-PU-2023-8481
ALT-PU-2024-17585
ALT-PU-2024-17593
BDU:2023-04348
BIT-JAVA-2023-22041
BIT-JAVA-MIN-2023-22041
BIT-JRE-2023-22041
CESA-2023_4159
CESA-2023_4175
CVE-2023-22041
DLA-3571-1
DSA-5458-1
DSA-5478-1
MGASA-2023-0272
OESA-2023-1600
OESA-2023-1601
OESA-2023-1602
OESA-2023-1603
OESA-2023-1617
OESA-2023-1618
OESA-2023-1650
OESA-2023-1737
OESA-2023-1738
OESA-2023-1739
OPENSUSE-SU-2023_3023-1
OPENSUSE-SU-2023_3287-1
OPENSUSE-SU-2023_3441-1
OPENSUSE-SU-2024:13075-1
OPENSUSE-SU-2024:13076-1
OPENSUSE-SU-2024:13130-1
OPENSUSE-SU-2024:13131-1
OPENSUSE-SU-2025:0066-1
OPENSUSE-SU-2025:0067-1
RHSA-2023:4157
RHSA-2023:4158
RHSA-2023:4159
RHSA-2023:4162
RHSA-2023:4163
RHSA-2023:4164
RHSA-2023:4165
RHSA-2023:4169
RHSA-2023:4170
RHSA-2023:4171
RHSA-2023:4175
RHSA-2023:4177
RHSA-2023:4233
RHSA-2023_4158
RHSA-2023_4159
RHSA-2023_4175
RHSA-2023_4177
RHSA-2023_4233
SUSE-SU-2023:2990-1
SUSE-SU-2023:3023-1
SUSE-SU-2023:3287-1
SUSE-SU-2023:3406-1
SUSE-SU-2023:3441-1
SUSE-SU-2023_2990-1
SUSE-SU-2023_3023-1
USN-6263-1
USN-6263-2
USN-6272-1

Affected Products

Alt Linux
Almalinux
Astra Linux
Centos
Graalvm Enterprise Edition
Graalvm For Jdk
Java Platform
Java Se
Linuxmint
Red Hat
Red Os
Suse
Ubuntu