CVE-2022-21291
First published: Tue Jan 18 2022(Updated: )
A flaw was found in the way the Hotspot component of OpenJDK processed classes with _fields that needed to be written to in Rewriter::scan_method(). A specially-crafted Java class file could use this flaw to crash Java virtual machine.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <11-openjdk-1:11.0.14.0.9-1.el7_9 | 11-openjdk-1:11.0.14.0.9-1.el7_9 |
| redhat/java | <17-openjdk-1:17.0.2.0.8-4.el8_5 | 17-openjdk-1:17.0.2.0.8-4.el8_5 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-2.el8_5 | 11-openjdk-1:11.0.14.0.9-2.el8_5 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-1.el8_1 | 11-openjdk-1:11.0.14.0.9-1.el8_1 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-1.el8_2 | 11-openjdk-1:11.0.14.0.9-1.el8_2 |
| redhat/java | <11-openjdk-1:11.0.14.0.9-2.el8_4 | 11-openjdk-1:11.0.14.0.9-2.el8_4 |
| debian/openjdk-11 | 11.0.16+8-1~deb10u1 11.0.21+9-1~deb10u1 11.0.20+8-1~deb11u1 11.0.21+9-1~deb11u1 11.0.22~6ea-1 | |
| debian/openjdk-17 | 17.0.7+7-1~deb11u1 17.0.9+9-1~deb11u1 17.0.9+9-1~deb12u1 17.0.9+9-2 17.0.10~6ea-1 | |
| IBM InfoSphere Guardium z/OS | <=10.5 | |
| IBM InfoSphere Guardium z/OS | <=10.6 | |
| IBM InfoSphere Guardium z/OS | <=11.0 | |
| IBM InfoSphere Guardium z/OS | <=11.1 | |
| IBM InfoSphere Guardium z/OS | <=11.3 | |
| IBM InfoSphere Guardium z/OS | <=11.2 | |
| IBM InfoSphere Guardium z/OS | <=11.4 | |
| Oracle GraalVM Enterprise Edition | =20.3.4 | |
| Oracle GraalVM Enterprise Edition | =21.3.0 | |
| Oracle JDK 6 | =1.7.0-update321 | |
| Oracle JDK 6 | =1.8.0-update311 | |
| Oracle JDK 6 | =11.0.13 | |
| Oracle JDK 6 | =17.0.1 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update321 | |
| Oracle Java Runtime Environment (JRE) | =1.8.0-update311 | |
| Oracle Java Runtime Environment (JRE) | =11.0.13 | |
| Oracle Java Runtime Environment (JRE) | =17.0.1 | |
| Debian | =10.0 | |
| Debian | =11.0 | |
| NetApp 7-Mode Transition Tool | ||
| NetApp Active IQ Unified Manager for VMware vSphere | ||
| netapp active iq unified manager windows | ||
| netapp cloud insights | ||
| NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.70.1 | |
| netapp e-series santricity storage manager | ||
| netapp e-series santricity Web services Web services proxy | ||
| netapp hci management node | ||
| NetApp OnCommand Insight | ||
| NetApp OnCommand Workflow Automation | ||
| netapp santricity unified manager | ||
| netapp snapmanager Oracle | ||
| netapp snapmanager sap | ||
| netapp solidfire | ||
| OpenJDK 17 | >=11<=11.0.13 | |
| OpenJDK 17 | >=13<=13.0.9 | |
| OpenJDK 17 | >=15<=15.0.5 | |
| OpenJDK 17 | =17 | |
| OpenJDK 17 | =17.0.1 | |
| netapp cloud insights acquisition unit | ||
| netapp cloud secure agent | ||
| NetApp SANtricity Storage Plugin for vCenter | ||
| Fedora | =34 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-21291 https://nvd.nist.gov/vuln/detail/CVE-2022-21291
- https://bugzilla.redhat.com/show_bug.cgi?id=2041831
- https://access.redhat.com/errata/RHSA-2022:0229
- https://access.redhat.com/errata/RHSA-2022:0166
- https://access.redhat.com/errata/RHSA-2022:0165
- https://access.redhat.com/errata/RHSA-2022:0204
- https://access.redhat.com/errata/RHSA-2022:0161
- https://access.redhat.com/errata/RHSA-2022:0185
- https://access.redhat.com/errata/RHSA-2022:0233
- https://access.redhat.com/errata/RHSA-2022:0209
- https://access.redhat.com/errata/RHSA-2022:0211
- https://access.redhat.com/errata/RHSA-2022:0228
- https://access.redhat.com/security/cve/cve-2022-21291
- https://security-tracker.debian.org/tracker/CVE-2022-21291
- https://www.oracle.com/security-alerts/cpujan2022.html#AppendixJAVA
- https://github.com/openjdk/jdk17u/commit/f8eb9abe034f7c6bea4da05a9ea42017b3f80730
- https://github.com/openjdk/jdk11u-dev/commit/41825fa33d605f8501164f9296572e4378e8183b
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/
- https://security.gentoo.org/glsa/202209-05
- https://security.netapp.com/advisory/ntap-20220121-0007/
- https://www.debian.org/security/2022/dsa-5057
- https://www.debian.org/security/2022/dsa-5058
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/217586
- https://www.ibm.com/support/pages/node/6572983 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-21291?
CVE-2022-21291 is an unspecified vulnerability in Java SE related to the VM component that could allow an unauthenticated attacker to exploit it.
What versions of Oracle Java SE are affected by CVE-2022-21291?
Oracle Java SE versions 7u321, 8u311, 11.0.13, and 17.0.1 are affected by CVE-2022-21291.
What versions of Oracle GraalVM Enterprise Edition are affected by CVE-2022-21291?
Oracle GraalVM Enterprise Edition versions 20.3.4 and 21.3.0 are affected by CVE-2022-21291.
How severe is CVE-2022-21291?
CVE-2022-21291 has a severity rating of 5.3 (medium).
Where can I find more information about CVE-2022-21291?
You can find more information about CVE-2022-21291 at the following references: [Oracle Security Alerts](https://www.oracle.com/security-alerts/cpujan2022.html#AppendixJAVA) and [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:0161) and [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:0233).
- collector/redhat-cve
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-21291
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/event
- agent/trending
- agent/source
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- collector/nvd-api
- source/NVD
- package-manager/redhat
- package-manager/debian
- vendor/ibm
- canonical/ibm infosphere guardium z/os
- version/ibm infosphere guardium z/os/10.5
- version/ibm infosphere guardium z/os/10.6
- version/ibm infosphere guardium z/os/11.0
- version/ibm infosphere guardium z/os/11.1
- version/ibm infosphere guardium z/os/11.3
- version/ibm infosphere guardium z/os/11.2
- version/ibm infosphere guardium z/os/11.4
- vendor/oracle
- canonical/oracle graalvm enterprise edition
- version/oracle graalvm enterprise edition/20.3.4
- version/oracle graalvm enterprise edition/21.3.0
- canonical/oracle jdk 6
- version/oracle jdk 6/1.7.0-update321
- version/oracle jdk 6/1.8.0-update311
- version/oracle jdk 6/11.0.13
- version/oracle jdk 6/17.0.1
- canonical/oracle java runtime environment (jre)
- version/oracle java runtime environment (jre)/1.7.0-update321
- version/oracle java runtime environment (jre)/1.8.0-update311
- version/oracle java runtime environment (jre)/11.0.13
- version/oracle java runtime environment (jre)/17.0.1
- vendor/debian
- canonical/debian
- version/debian/10.0
- version/debian/11.0
- vendor/netapp
- canonical/netapp 7-mode transition tool
- canonical/netapp active iq unified manager for vmware vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp cloud insights
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0.0
- version/netapp e-series santricity os controller/11.70.1
- canonical/netapp e-series santricity storage manager
- canonical/netapp e-series santricity web services web services proxy
- canonical/netapp hci management node
- canonical/netapp oncommand insight
- canonical/netapp oncommand workflow automation
- canonical/netapp santricity unified manager
- canonical/netapp snapmanager oracle
- canonical/netapp snapmanager sap
- canonical/netapp solidfire
- canonical/openjdk 17
- version/openjdk 17/11
- version/openjdk 17/11.0.13
- version/openjdk 17/13
- version/openjdk 17/13.0.9
- version/openjdk 17/15
- version/openjdk 17/15.0.5
- version/openjdk 17/17
- version/openjdk 17/17.0.1
- canonical/netapp cloud insights acquisition unit
- canonical/netapp cloud secure agent
- canonical/netapp santricity storage plugin for vcenter
- vendor/fedoraproject
- canonical/fedora
- version/fedora/34