CVE-2022-21291
First published: Tue Jan 18 2022(Updated: )
A flaw was found in the way the Hotspot component of OpenJDK processed classes with _fields that needed to be written to in Rewriter::scan_method(). A specially-crafted Java class file could use this flaw to crash Java virtual machine.
Credit: secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <11-openjdk-1:11.0.14.0.9-1.el7_9 | 11-openjdk-1:11.0.14.0.9-1.el7_9 |
| redhat/java | <17-openjdk-1:17.0.2.0.8-4.el8_5 | 17-openjdk-1:17.0.2.0.8-4.el8_5 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-2.el8_5 | 11-openjdk-1:11.0.14.0.9-2.el8_5 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-1.el8_1 | 11-openjdk-1:11.0.14.0.9-1.el8_1 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-1.el8_2 | 11-openjdk-1:11.0.14.0.9-1.el8_2 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-2.el8_4 | 11-openjdk-1:11.0.14.0.9-2.el8_4 |
| debian/openjdk-11 | 11.0.16+8-1~deb10u1 11.0.21+9-1~deb10u1 11.0.20+8-1~deb11u1 11.0.21+9-1~deb11u1 11.0.22~6ea-1 | |
| debian/openjdk-17 | 17.0.7+7-1~deb11u1 17.0.9+9-1~deb11u1 17.0.9+9-1~deb12u1 17.0.9+9-2 17.0.10~6ea-1 | |
| Oracle GraalVM | =20.3.4 | |
| Oracle GraalVM | =21.3.0 | |
| Oracle JDK | =1.7.0-update321 | |
| Oracle JDK | =1.8.0-update311 | |
| Oracle JDK | =11.0.13 | |
| Oracle JDK | =17.0.1 | |
| Oracle JRE | =1.7.0-update321 | |
| Oracle JRE | =1.8.0-update311 | |
| Oracle JRE | =11.0.13 | |
| Oracle JRE | =17.0.1 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| NetApp 7-Mode Transition Tool | ||
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows | ||
| Netapp Cloud Insights Acquisition Unit | ||
| Netapp Cloud Secure Agent | ||
| NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.70.1 | |
| Netapp E-series Santricity Storage Manager | ||
| Netapp E-series Santricity Web Services Web Services Proxy | ||
| Netapp Hci Management Node | ||
| NetApp OnCommand Insight | ||
| NetApp OnCommand Workflow Automation | ||
| Netapp Santricity Storage Plugin Vcenter | ||
| Netapp Santricity Unified Manager | ||
| Netapp Snapmanager Oracle | ||
| Netapp Snapmanager Sap | ||
| Netapp Solidfire | ||
| Oracle Openjdk | >=11<=11.0.13 | |
| Oracle Openjdk | >=13<=13.0.9 | |
| Oracle Openjdk | >=15<=15.0.5 | |
| Oracle Openjdk | =17 | |
| Oracle Openjdk | =17.0.1 | |
| Fedoraproject Fedora | =34 | |
| Netapp Cloud Insights |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-21291 https://nvd.nist.gov/vuln/detail/CVE-2022-21291
- https://bugzilla.redhat.com/show_bug.cgi?id=2041831
- https://access.redhat.com/errata/RHSA-2022:0229
- https://access.redhat.com/errata/RHSA-2022:0166
- https://access.redhat.com/errata/RHSA-2022:0165
- https://access.redhat.com/errata/RHSA-2022:0204
- https://access.redhat.com/errata/RHSA-2022:0161
- https://access.redhat.com/errata/RHSA-2022:0185
- https://access.redhat.com/errata/RHSA-2022:0233
- https://access.redhat.com/errata/RHSA-2022:0209
- https://access.redhat.com/errata/RHSA-2022:0211
- https://access.redhat.com/errata/RHSA-2022:0228
- https://access.redhat.com/security/cve/cve-2022-21291
- https://exchange.xforce.ibmcloud.com/vulnerabilities/217586
- https://www.ibm.com/support/pages/node/6578583 (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/
- https://security.gentoo.org/glsa/202209-05
- https://security.netapp.com/advisory/ntap-20220121-0007/
- https://www.debian.org/security/2022/dsa-5057
- https://www.debian.org/security/2022/dsa-5058
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security-tracker.debian.org/tracker/CVE-2022-21291
- https://www.oracle.com/security-alerts/cpujan2022.html#AppendixJAVA
- https://github.com/openjdk/jdk17u/commit/f8eb9abe034f7c6bea4da05a9ea42017b3f80730
- https://github.com/openjdk/jdk11u-dev/commit/41825fa33d605f8501164f9296572e4378e8183b
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-21291?
CVE-2022-21291 is an unspecified vulnerability in Java SE related to the VM component that could allow an unauthenticated attacker to exploit it.
What versions of Oracle Java SE are affected by CVE-2022-21291?
Oracle Java SE versions 7u321, 8u311, 11.0.13, and 17.0.1 are affected by CVE-2022-21291.
What versions of Oracle GraalVM Enterprise Edition are affected by CVE-2022-21291?
Oracle GraalVM Enterprise Edition versions 20.3.4 and 21.3.0 are affected by CVE-2022-21291.
How severe is CVE-2022-21291?
CVE-2022-21291 has a severity rating of 5.3 (medium).
Where can I find more information about CVE-2022-21291?
You can find more information about CVE-2022-21291 at the following references: [Oracle Security Alerts](https://www.oracle.com/security-alerts/cpujan2022.html#AppendixJAVA) and [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:0161) and [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:0233).
- collector/redhat-cve
- collector/ibm-support
- collector/security-tracker-debian
- agent/author
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-21291
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/references
- agent/event
- agent/description
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- package-manager/debian
- vendor/oracle
- canonical/oracle graalvm
- version/oracle graalvm/20.3.4
- version/oracle graalvm/21.3.0
- canonical/oracle jdk
- version/oracle jdk/1.7.0-update321
- version/oracle jdk/1.8.0-update311
- version/oracle jdk/11.0.13
- version/oracle jdk/17.0.1
- canonical/oracle jre
- version/oracle jre/1.7.0-update321
- version/oracle jre/1.8.0-update311
- version/oracle jre/11.0.13
- version/oracle jre/17.0.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- vendor/netapp
- canonical/netapp 7-mode transition tool
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp cloud insights acquisition unit
- canonical/netapp cloud secure agent
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0.0
- version/netapp e-series santricity os controller/11.70.1
- canonical/netapp e-series santricity storage manager
- canonical/netapp e-series santricity web services web services proxy
- canonical/netapp hci management node
- canonical/netapp oncommand insight
- canonical/netapp oncommand workflow automation
- canonical/netapp santricity storage plugin vcenter
- canonical/netapp santricity unified manager
- canonical/netapp snapmanager oracle
- canonical/netapp snapmanager sap
- canonical/netapp solidfire
- canonical/oracle openjdk
- version/oracle openjdk/11
- version/oracle openjdk/11.0.13
- version/oracle openjdk/13
- version/oracle openjdk/13.0.9
- version/oracle openjdk/15
- version/oracle openjdk/15.0.5
- version/oracle openjdk/17
- version/oracle openjdk/17.0.1
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- canonical/netapp cloud insights