CVE-2022-21283: Medium severity Oracle GraalVM vulnerability
A flaw was found in the Pattern class implementation in the Libraries component of OpenJDK. A specially crated input could cause the Pattern class to raise an unexpected exception while performing regular expression matching, possibly causing a Java application using the class to misbehave.
Other sources
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-21283?
The severity of CVE-2022-21283 is classified as moderate, potentially leading to unexpected behavior in Java applications using the Pattern class.
How do I fix CVE-2022-21283?
To fix CVE-2022-21283, update to the recommended versions of OpenJDK as specified in the official advisories for your distribution.
Which versions of OpenJDK are affected by CVE-2022-21283?
CVE-2022-21283 affects multiple versions of OpenJDK, specifically versions up to 11.0.14 and 1.8.0.322 across different distributions.
What type of vulnerability is CVE-2022-21283?
CVE-2022-21283 is a vulnerability in the Pattern class of OpenJDK, related to improper handling of regular expressions.
Can CVE-2022-21283 be exploited remotely?
CVE-2022-21283 does not explicitly state remote exploitation but could be exploited through crafted inputs in applications that handle user input.