CVE-2023-22044: Low severity oracle graalvm enterprise edition vulnerability
A flaw was found in the way the Hotspot component of OpenJDK handled array accesses using the binary % operator. This flaw could lead to an access at an invalid array position, leading to an out-of-bounds read vulnerability.
Other sources
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-22044?
CVE-2023-22044 is a vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product.
Which versions are affected by CVE-2023-22044?
The affected versions are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7, 20.0.1.
What is the severity of CVE-2023-22044?
CVE-2023-22044 has a severity rating of 3.7 (low).
How do I fix CVE-2023-22044 in Oracle Java SE?
To fix CVE-2023-22044 in Oracle Java SE, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM?
To fix CVE-2023-22044 in Oracle GraalVM, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM for JDK?
To fix CVE-2023-22044 in Oracle GraalVM for JDK, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Ubuntu openjdk-17?
To fix CVE-2023-22044 in Ubuntu openjdk-17, update to version 17.0.8+7-1~18.04 (for Bionic), 17.0.8+7-1~20.04.2 (for Focal), 17.0.8+7-1~22.04 (for Jammy), or 17.0.8+7-1~23.04 (for Lunar).
How do I fix CVE-2023-22044 in Ubuntu openjdk-20?
To fix CVE-2023-22044 in Ubuntu openjdk-20, update to version 20.0.2+9+ (for Lunar).
How do I fix CVE-2023-22044 in Oracle GraalVM 21.3.6?
To fix CVE-2023-22044 in Oracle GraalVM 21.3.6, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM 22.3.2?
To fix CVE-2023-22044 in Oracle GraalVM 22.3.2, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM for JDK 17.0.7?
To fix CVE-2023-22044 in Oracle GraalVM for JDK 17.0.7, update to the latest version available from Oracle's security alerts page.
How do I fix CVE-2023-22044 in Oracle GraalVM for JDK 20.0.1?
To fix CVE-2023-22044 in Oracle GraalVM for JDK 20.0.1, update to the latest version available from Oracle's security alerts page.