PT-2023-4051 · Oracle+8 · Graalvm For Jdk+11

Eirik Bjørsnøs

·

Published

2023-07-18

·

Updated

2026-05-08

·

CVE-2023-22036

CVSS v3.1

3.7

Low

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 11.0.19, 17.0.7, 20.0.1 Oracle GraalVM Enterprise Edition versions 20.3.10, 21.3.6, 22.3.2 Oracle GraalVM for JDK versions 17.0.7, 20.0.1
Description The issue is related to errors in processing input data in the Utility component of Oracle Java SE, Oracle GraalVM Enterprise Edition, and Oracle GraalVM for JDK. It allows an unauthenticated attacker with network access via multiple protocols to compromise these systems. Successful attacks can result in unauthorized ability to cause a partial denial of service. This vulnerability can be exploited by using APIs in the specified component, for example, through a web service that supplies data to the APIs. It also applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security.
Recommendations For Oracle Java SE version 11.0.19, update to a newer version to mitigate the risk. For Oracle Java SE version 17.0.7, update to a newer version to mitigate the risk. For Oracle Java SE version 20.0.1, update to a newer version to mitigate the risk. For Oracle GraalVM Enterprise Edition version 20.3.10, update to a newer version to mitigate the risk. For Oracle GraalVM Enterprise Edition version 21.3.6, update to a newer version to mitigate the risk. For Oracle GraalVM Enterprise Edition version 22.3.2, update to a newer version to mitigate the risk. For Oracle GraalVM for JDK version 17.0.7, update to a newer version to mitigate the risk. For Oracle GraalVM for JDK version 20.0.1, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the vulnerable Utility component until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2023:4158
ALSA-2023:4159
ALSA-2023:4175
ALSA-2023:4177
ALT-PU-2023-8475
ALT-PU-2023-8476
ALT-PU-2023-8478
ALT-PU-2023-8479
ALT-PU-2023-8480
ALT-PU-2023-8481
ALT-PU-2024-17585
ALT-PU-2024-17593
BDU:2023-04349
BIT-JAVA-2023-22036
BIT-JAVA-MIN-2023-22036
BIT-JRE-2023-22036
CESA-2023_4159
CESA-2023_4175
CVE-2023-22036
DLA-3571-1
DSA-5458-1
DSA-5478-1
MGASA-2023-0272
OESA-2023-1617
OESA-2023-1618
OESA-2023-1737
OESA-2023-1738
OESA-2023-1739
OPENSUSE-SU-2023_3023-1
OPENSUSE-SU-2023_3287-1
OPENSUSE-SU-2023_3441-1
OPENSUSE-SU-2024:13075-1
OPENSUSE-SU-2024:13076-1
OPENSUSE-SU-2025:0066-1
OPENSUSE-SU-2025:0067-1
RHSA-2023:4157
RHSA-2023:4158
RHSA-2023:4159
RHSA-2023:4162
RHSA-2023:4163
RHSA-2023:4164
RHSA-2023:4165
RHSA-2023:4169
RHSA-2023:4170
RHSA-2023:4171
RHSA-2023:4175
RHSA-2023:4177
RHSA-2023:4233
RHSA-2023_4158
RHSA-2023_4159
RHSA-2023_4175
RHSA-2023_4177
RHSA-2023_4233
SUSE-SU-2023:2990-1
SUSE-SU-2023:3023-1
SUSE-SU-2023:3287-1
SUSE-SU-2023:3406-1
SUSE-SU-2023:3441-1
SUSE-SU-2023_2990-1
SUSE-SU-2023_3023-1
USN-6263-1
USN-6263-2
USN-6272-1

Affected Products

Alt Linux
Almalinux
Astra Linux
Centos
Graalvm Enterprise Edition
Graalvm For Jdk
Java Platform
Java Se
Linuxmint
Red Hat
Suse
Ubuntu