CVE-2023-22044
First published: Mon Jul 10 2023(Updated: )
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Credit: secalert_us@oracle.com secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle GraalVM | =21.3.6 | |
| Oracle GraalVM | =22.3.2 | |
| Oracle GraalVM for JDK | =17.0.7 | |
| Oracle GraalVM for JDK | =20.0.1 | |
| Oracle JDK | =1.8.0-update371 | |
| Oracle JDK | =17.0.7 | |
| Oracle JDK | =20.0.1 | |
| Oracle JRE | =1.8.0-update371 | |
| Oracle JRE | =17.0.7 | |
| Oracle JRE | =20.0.1 | |
| Debian Debian Linux | =11.0 | |
| Debian Debian Linux | =12.0 | |
| ubuntu/openjdk-17 | <17.0.8+7-1~18.04 | 17.0.8+7-1~18.04 |
| ubuntu/openjdk-17 | <17.0.8+7-1~20.04.2 | 17.0.8+7-1~20.04.2 |
| ubuntu/openjdk-17 | <17.0.8+7-1~22.04 | 17.0.8+7-1~22.04 |
| ubuntu/openjdk-17 | <17.0.8+7-1~23.04 | 17.0.8+7-1~23.04 |
| ubuntu/openjdk-20 | <20.0.2+9+ | 20.0.2+9+ |
| debian/openjdk-17 | <=17.0.7+7-1~deb11u1 | 17.0.10+7-1~deb11u1 17.0.9+9-1~deb12u1 17.0.10+7-1~deb12u1 17.0.10+7-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.oracle.com/security-alerts/cpujul2023.html
- https://security.netapp.com/advisory/ntap-20230725-0006/
- https://www.debian.org/security/2023/dsa-5458
- https://launchpad.net/bugs/cve/CVE-2023-22044
- https://access.redhat.com/errata/RHSA-2023:4170
- https://access.redhat.com/errata/RHSA-2023:4171
- https://access.redhat.com/errata/RHSA-2023:4169
- https://access.redhat.com/errata/RHSA-2023:4210
- https://access.redhat.com/errata/RHSA-2023:4211
- https://access.redhat.com/errata/RHSA-2023:4177
- https://access.redhat.com/errata/RHSA-2023:4159
- https://access.redhat.com/security/cve/cve-2023-22044
- https://github.com/openjdk/jdk17u/commit/811f3a16ec4d4054b9b78e5764573bb1f6b5ebb5
- https://www.oracle.com/security-alerts/cpujul2023.html#AppendixJAVA
- https://www.oracle.com/java/technologies/javase/8u381-perf-relnotes.html
- https://www.oracle.com/java/technologies/javase/17-0-8-relnotes.html
- https://www.oracle.com/java/technologies/javase/20-0-2-relnotes.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2221642
- https://security-tracker.debian.org/tracker/CVE-2023-22044
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22044
- https://ubuntu.com/security/notices/USN-6263-1
- https://ubuntu.com/security/notices/USN-6272-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-22044
- https://ubuntu.com/security/CVE-2023-22044
Frequently Asked Questions
What is CVE-2023-22044?
CVE-2023-22044 is a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product.
Which versions are affected by CVE-2023-22044?
The affected versions are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7, 20.0.1.
What is the severity of CVE-2023-22044?
CVE-2023-22044 has a severity rating of 3.7 (low).
How do I fix CVE-2023-22044 in Oracle Java SE?
To fix CVE-2023-22044 in Oracle Java SE, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM?
To fix CVE-2023-22044 in Oracle GraalVM, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM for JDK?
To fix CVE-2023-22044 in Oracle GraalVM for JDK, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Ubuntu openjdk-17?
To fix CVE-2023-22044 in Ubuntu openjdk-17, update to version 17.0.8+7-1~18.04 (for Bionic), 17.0.8+7-1~20.04.2 (for Focal), 17.0.8+7-1~22.04 (for Jammy), or 17.0.8+7-1~23.04 (for Lunar).
How do I fix CVE-2023-22044 in Ubuntu openjdk-20?
To fix CVE-2023-22044 in Ubuntu openjdk-20, update to version 20.0.2+9+ (for Lunar).
How do I fix CVE-2023-22044 in Oracle GraalVM 21.3.6?
To fix CVE-2023-22044 in Oracle GraalVM 21.3.6, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM 22.3.2?
To fix CVE-2023-22044 in Oracle GraalVM 22.3.2, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM for JDK 17.0.7?
To fix CVE-2023-22044 in Oracle GraalVM for JDK 17.0.7, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM for JDK 20.0.1?
To fix CVE-2023-22044 in Oracle GraalVM for JDK 20.0.1, update to the latest version available from Oracle's security alerts page.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/nvd-latest
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-22044
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- vendor/oracle
- canonical/oracle graalvm
- version/oracle graalvm/21.3.6
- version/oracle graalvm/22.3.2
- canonical/oracle graalvm for jdk
- version/oracle graalvm for jdk/17.0.7
- version/oracle graalvm for jdk/20.0.1
- canonical/oracle jdk
- version/oracle jdk/1.8.0-update371
- version/oracle jdk/17.0.7
- version/oracle jdk/20.0.1
- canonical/oracle jre
- version/oracle jre/1.8.0-update371
- version/oracle jre/17.0.7
- version/oracle jre/20.0.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- version/debian debian linux/12.0
- package-manager/debian
- package-manager/ubuntu