Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
References
| Link | Resource |
|---|---|
| https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html | Mailing List Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230725-0006/ | Third Party Advisory |
| https://www.debian.org/security/2023/dsa-5458 | Third Party Advisory |
| https://www.debian.org/security/2023/dsa-5478 | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2023.html | Patch Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html | Mailing List Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230725-0006/ | Third Party Advisory |
| https://www.debian.org/security/2023/dsa-5458 | Third Party Advisory |
| https://www.debian.org/security/2023/dsa-5478 | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2023.html | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 07:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html - Mailing List, Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20230725-0006/ - Third Party Advisory | |
| References | () https://www.debian.org/security/2023/dsa-5458 - Third Party Advisory | |
| References | () https://www.debian.org/security/2023/dsa-5478 - Third Party Advisory | |
| References | () https://www.oracle.com/security-alerts/cpujul2023.html - Patch, Vendor Advisory |
26 Jan 2024, 16:48
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.debian.org/security/2023/dsa-5478 - Third Party Advisory | |
| References | (MISC) https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html - Mailing List, Third Party Advisory | |
| First Time |
Netapp
Netapp active Iq Unified Manager Netapp cloud Insights Acquisition Unit Netapp oncommand Insight Netapp cloud Insights Storage Workload Security Agent Netapp 7-mode Transition Tool |
19 Sep 2023, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Aug 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Jul 2023, 17:33
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:oracle:graalvm:21.3.6:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:graalvm:20.3.10:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:jre:17.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm:22.3.2:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:jdk:20.0.1:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm_for_jdk:20.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:jre:1.8.0:update371:*:*:enterprise_performance_pack:*:*:* cpe:2.3:a:oracle:jre:11.0.19:*:*:*:*:*:*:* cpe:2.3:a:oracle:jre:20.0.1:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdk:1.8.0:update371:*:*:enterprise_performance_pack:*:*:* cpe:2.3:a:oracle:jdk:11.0.19:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm_for_jdk:17.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdk:17.0.7:*:*:*:*:*:*:* |
|
| First Time |
Debian debian Linux
Oracle Oracle jre Oracle graalvm For Jdk Oracle graalvm Oracle jdk Debian |
|
| References | (MISC) https://www.debian.org/security/2023/dsa-5458 - Third Party Advisory | |
| References | (MISC) https://www.oracle.com/security-alerts/cpujul2023.html - Patch, Vendor Advisory | |
| References | (MISC) https://security.netapp.com/advisory/ntap-20230725-0006/ - Third Party Advisory |
26 Jul 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jul 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Jul 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-18 21:15
Updated : 2024-11-21 07:44
NVD link : CVE-2023-22041
Mitre link : CVE-2023-22041
CVE.ORG link : CVE-2023-22041
JSON object : View
Products Affected
debian
- debian_linux
netapp
- cloud_insights_storage_workload_security_agent
- cloud_insights_acquisition_unit
- active_iq_unified_manager
- 7-mode_transition_tool
- oncommand_insight
oracle
- jre
- graalvm_for_jdk
- jdk
- graalvm
CWE