CVE-2022-21541: Medium severity oracle graalvm enterprise edition vulnerability
An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact.
Other sources
It was discovered that the Hotspot component of OpenJDK did not properly restrict access to the invokeBasic() method of the MethodHandle class. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
— Red Hat
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Com
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21541?
CVE-2022-21541 has high integrity impact while posing no confidentiality or availability impact.
How do I fix CVE-2022-21541?
To fix CVE-2022-21541, update to the recommended patch version of OpenJDK or related software as specified in security advisories.
Which software versions are affected by CVE-2022-21541?
CVE-2022-21541 affects certain versions of OpenJDK, GraalVM, Oracle JDK, and Java Runtime Environment (JRE) among others.
Can CVE-2022-21541 be exploited remotely?
CVE-2022-21541 can allow unauthenticated attackers to exploit the vulnerability under certain conditions.
What components are involved in CVE-2022-21541?
CVE-2022-21541 involves a vulnerability within the VM component of Java SE, specifically pertaining to the Hotspot component of OpenJDK.