CVE catalog

CVE-2022-21282

openjdk-17: CVE-2022-21282

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.88% · Oct 25, 2026

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenjdk-17sid17.0.21+9-1fixed
Debianopenjdk-17bookworm17.0.19+10-1~deb12u2fixed
Debianopenjdk-17bookworm-security17.0.21+9-1~deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenjdk-17sourcesid17.0.2+8-1not yet assignedNot reportedNot reported
Debianopenjdk-17sourcebookworm17.0.2+8-1not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [openjdk-17-dbg]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-demo]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-doc]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-jdk]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-jdk-headless]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-jre]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-jre-headless]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-jre-zero]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

  • [openjdk-17-source]Fixed

    Source package: [openjdk-17]

    Details (4)

    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.2+8-1

      dsa · openjdk-17 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]