REDHAT-BUG-2075849

First published: Fri Apr 15 2022(Updated: )

Inconsistencies were found in the way the java.net.URI and com.sun.jndi.toolkit.url.URI classes in the JNDI component of OpenJDK parsed URI strings. These inconsistencies could be used to make a Java application accept invalid or malformed URI strings. Parsing of URL strings in built-in JNDI providers were made more strict as part of the fix. For more information, see the following release notes for Oracle JDK 7u341, 8u331, 11.0.15, 17.0.3, 18.0.1: <a href="https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#JDK-8278972">https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#JDK-8278972</a> <a href="https://www.oracle.com/java/technologies/javase/8u331-relnotes.html#JDK-8278972">https://www.oracle.com/java/technologies/javase/8u331-relnotes.html#JDK-8278972</a> <a href="https://www.oracle.com/java/technologies/javase/11-0-15-relnotes.html#JDK-8278972">https://www.oracle.com/java/technologies/javase/11-0-15-relnotes.html#JDK-8278972</a> <a href="https://www.oracle.com/java/technologies/javase/17-0-3-relnotes.html#JDK-8278972">https://www.oracle.com/java/technologies/javase/17-0-3-relnotes.html#JDK-8278972</a> <a href="https://www.oracle.com/java/technologies/javase/18-0-1-relnotes.html#JDK-8278972">https://www.oracle.com/java/technologies/javase/18-0-1-relnotes.html#JDK-8278972</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2022-21496
• agent/type
• agent/references
• agent/last-modified-date
• agent/first-publish-date
• agent/severity
• agent/description
• agent/event
• agent/source
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/oracle
• canonical/oracle openjdk 1.8.0
• vendor/openjdk
• canonical/openjdk jndi