Security Bulletin: CVE-2022-3676 may affect IBM® SDK, Java™ Technology Edition

Summary

CVE-2022-3676 was addressed in Eclipse OpenJ9 version 0.35

Vulnerability Details

CVEID:CVE-2022-3676
**DESCRIPTION:**Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a specially-crafted request using bytecode, an attacker could exploit this vulnerability to access or modify memory.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239608 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

7.0.0.0 - 7.0.11.10
7.1.0.0 - 7.1.5.10
8.0.0.0 - 8.0.7.16

Note: CVE-2022-3676 is not applicable to IBM SDK, Java Technology Edition on Solaris, HP-UX and Mac OS.

Remediation/Fixes

7.0.11.15
7.1.5.15
8.0.7.20

IBM SDK, Java Technology Edition releases can be downloaded, subject to the terms of the developerWorks license, from the Java Developer Center.

IBM customers requiring an update for an SDK shipped with an IBM product should contact IBM support, and/or refer to the appropriate product security bulletin.

Workarounds and Mitigations

None