CVE-2022-21360 is a medium-severity vulnerability affecting Oracle Java SE (versions 7u321, 8u311, 11.0.13, 17.0.1) and Oracle GraalVM Enterprise Edition (versions 20.3.4, 21.3.0) within the ImageIO component. This easily exploitable flaw allows an unauthenticated attacker with network access to cause a partial denial of service. While it primarily impacts sandboxed Java applications, it can also be exploited via APIs. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20.3.4CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:* | ||
21.3.0CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update321:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update311:*:*:*:*:*:* | ||
11.0.13CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:11.0.13:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
Jan 18, 2022Vulnerability in the Oracle Java SE Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321 8u311 11.0.13 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component e.g. through a web service which supplies data
Jan 11, 2022