CVE-2022-21426: Medium severity Oracle GraalVM vulnerability

It was discovered that the XPath class in the JAXP component in OpenJDK failed to sufficiently limit the amount of memory allocated when compiling a specially crafted XPath expression. This could possibly cause a Java application to exit because of an out of memory (OOM) error if it processed untrusted XPath expressions.

Three new XML processing limits are introduced to the XML libraries as part of the fix:

- jdk.xml.xpathExprGrpLimit limits the number of groups an XPath expression can contain. - jdk.xml.xpathExprOpLimit limits the number of operators an XPath expression can contain. - jdk.xml.xpathTotalOpLimit limits the total number of XPath operators in an XSL Stylesheet.

See the following release notes for Oracle JDK 7u341, 8u331, 11.0.15, 17.0.3, 18.0.1:

https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/8u331-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/11-0-15-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/17-0-3-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/18-0-1-relnotes.html#JDK-8270504

— Red Hat

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).