CVE-2022-21365 is a partial denial-of-service vulnerability affecting Oracle Java SE (versions 7u321, 8u311, 11.0.13, 17.0.1) and Oracle GraalVM Enterprise Edition (versions 20.3.4, 21.3.0), specifically within the ImageIO component. This easily exploitable flaw allows an unauthenticated attacker with network access to disrupt the availability of affected systems. With a CVSS v3.1 base score of 5.3 (Medium), the vulnerability can be triggered via multiple protocols and primarily impacts Java deployments running untrusted code in sandboxed environments or through API calls. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20.3.4CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:* | ||
21.3.0CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update321:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update311:*:*:*:*:*:* | ||
11.0.13CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:11.0.13:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)
Jan 18, 2022Vulnerability in the Oracle Java SE Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321 8u311 11.0.13 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component e.g. through a web service which supplies data
Jan 11, 2022