Advisory ROSA-SA-2023-2135

2023-03-2813:24:18

ROSA LAB

abf.rosalinux.ru

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.5 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.2%

JSON

Software: java-11-openjdk 11.0.18.0.10-1
OS: rosa-server79

package_evr_string: 11.0.18.0.10-1

CVE-ID: CVE-2022-21366
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC: An easily exploitable vulnerability allows an unauthorized attacker with network access through multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks against this vulnerability could result in an unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
CVE-STATUS: Fixed
CVE-REV: Run the yum update java-11-openjdk command to close.

CVE-ID: CVE-2022-21341
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC: An easily exploitable vulnerability allows an unauthorized attacker with network access through multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks against this vulnerability could result in an unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
CVE-STATUS: Fixed
CVE-REV: Run the yum update java-11-openjdk command to close.

CVE-ID: CVE-2022-21340
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC: An easily exploitable vulnerability allows an unauthenticated attacker with network access through multiple protocols to compromise Oracle Java SE and Oracle GraalVM Enterprise Edition. Successful attacks against this vulnerability could result in an unauthorized ability to cause partial denial of service (partial DOS) of Oracle Java SE and Oracle GraalVM Enterprise Edition.
CVE-STATUS: Fixed
CVE-REV: Run the yum update java-11-openjdk command to close it

CVE-ID: CVE-2022-21305
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC: An easily exploitable vulnerability allows an unauthenticated attacker with network access through multiple protocols to compromise Oracle Java SE and Oracle GraalVM Enterprise Edition. Successful attacks against this vulnerability could result in unauthorized access to update, insert, or delete data accessed in Oracle Java SE and Oracle GraalVM Enterprise Edition.
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update java-11-openjdk command

CVE-ID: CVE-2022-21277
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC: An easily exploitable vulnerability allows an unauthenticated attacker with network access through multiple protocols to compromise Oracle Java SE and Oracle GraalVM Enterprise Edition. Successful attacks against this vulnerability could result in an unauthorized ability to cause a partial denial of service (partial DOS) in Oracle Java SE and Oracle GraalVM Enterprise Edition.
CVE-STATUS: Fixed
CVE-REV: Run the yum update java-11-openjdk command to close.