CVE-2022-21541: azul zulu

Modified

AliasesUBUNTU-CVE-2022-21541DEBIAN-CVE-2022-21541CGA-6r2h-3jv7-rch6+42 more

Published 19-07-2022Last modified 23-09-2024

Vulnerability summary

CVE-2022-21541 is a medium (CVSS 5.9) vulnerability in azul zulu. EPSS estimates a 2.91% chance of exploitation in the next 30 days, higher than 86.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.9/10

010

Medium · v3.1 (CVE.org)

EPSS score

2.91%

0%100%

Low · +0.16 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

19-07-2022
PublishedVulnerability first disclosed.
23-09-2024
Last modifiedVulnerability information updated.

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.9

EPSS trend

Probability

2.91%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

Increase +0.16 pp

From 2.75% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard21 products

openjdk-10All versions (No fix recorded)
openjdk-11-openj9-default-policy< 0.53.0-r0
openjdk-13-jre-baseAll versions (No fix recorded)
openjdk-15-jreAll versions (No fix recorded)
openjdk-16-jreAll versions (No fix recorded)

Show all 21

Netapp8 products

Show all 8

Ubuntu8 products

icedtea-webAll versions (No fix recorded)
openjdk-13All versions (No fix recorded)
openjdk-16All versions (No fix recorded)
openjdk-17< 17.0.4+8-1~18.04 | < 17.0.4+8-1~20.04 | < 17.0.4+8-1~22.04
openjdk-18< 18.0.2+9-2~22.04

Show all 8

Alpine5 products

openjdk11< 11.0.17_p8-r0 | < 11.0.16_p8-r0
openjdk13< 13.0.12_p4-r0
openjdk15< 15.0.8_p4-r0
openjdk17< 17.0.4_p8-r0
openjdk8< 8.345.01-r0

Wolfi5 products

openjdk-10All versions (No fix recorded)
openjdk-13-jre-baseAll versions (No fix recorded)
openjdk-15-jreAll versions (No fix recorded)
openjdk-16-jreAll versions (No fix recorded)
openjdk-9-jreAll versions (No fix recorded)

Oracle4 products

graalvmEOL20.3.6 | 21.3.2 | 22.1.0
jdkEOL1.7.0:update343 | 1.8.0:update333 | 11.0.15.1 | 17.0.3.1 | 18.0.1.1
jreEOL1.7.0:update343 | 1.8.0:update333 | 11.0.15.1 | 17.0.3.1 | 18.0.1.1
openjdkEOL≥ 11, ≤ 11.0.15 | ≥ 13, ≤ 13.0.11 | ≥ 15, ≤ 15.0.7 | ≥ 17, ≤ 17.0.3 | 7 | 7:update1 | 7:update10 | 7:update101 | 7:update11 | 7:update111 | 7:update121 | 7:update13 | 7:update131 | 7:update141 | 7:update15 | 7:update151 | 7:update161 | 7:update17 | 7:update171 | 7:update181 | 7:update191 | 7:update2 | 7:update201 | 7:update21 | 7:update211 | 7:update221 | 7:update231 | 7:update241 | 7:update25 | 7:update251 | 7:update261 | 7:update271 | 7:update281 | 7:update291 | 7:update3 | 7:update301 | 7:update311 | 7:update321 | 7:update4 | 7:update40 | 7:update45 | 7:update5 | 7:update51 | 7:update55 | 7:update6 | 7:update60 | 7:update65 | 7:update67 | 7:update7 | 7:update72 | 7:update76 | 7:update80 | 7:update85 | 7:update9 | 7:update91 | 7:update95 | 7:update97 | 7:update99 | 8 | 8:milestone1 | 8:milestone2 | 8:milestone3 | 8:milestone4 | 8:milestone5 | 8:milestone6 | 8:milestone7 | 8:milestone8 | 8:milestone9 | 8:update101 | 8:update102 | 8:update11 | 8:update111 | 8:update112 | 8:update121 | 8:update131 | 8:update141 | 8:update151 | 8:update152 | 8:update161 | 8:update162 | 8:update171 | 8:update172 | 8:update181 | 8:update191 | 8:update192 | 8:update20 | 8:update201 | 8:update202 | 8:update211 | 8:update212 | 8:update221 | 8:update222 | 8:update231 | 8:update232 | 8:update241 | 8:update242 | 8:update25 | 8:update252 | 8:update262 | 8:update271 | 8:update281 | 8:update282 | 8:update291 | 8:update301 | 8:update302 | 8:update31 | 8:update312 | 8:update322 | 8:update332 | 8:update40 | 8:update45 | 8:update5 | 8:update51 | 8:update60 | 8:update65 | 8:update66 | 8:update71 | 8:update72 | 8:update73 | 8:update74 | 8:update77 | 8:update91 | 8:update92 | 18

Debian2 products

openjdk-17< 17.0.4+8-1
debian_linuxEOL10.0 | 11.0

Azul1 product

zuluEOL7.54 | 8.62 | 11.56 | 13.48 | 15.40 | 17.34 | 18.30

Fedoraproject1 product

fedoraEOL36

Oracle corporation1 product

java se jdk and jreOracle Java SE:7u343 | Oracle Java SE:8u333 | Oracle Java SE:11.0.15.1 | Oracle Java SE:17.0.3.1 | Oracle Java SE:18.0.1.1 | Oracle GraalVM Enterprise Edition:20.3.6 | Oracle GraalVM Enterprise Edition:21.3.2 | Oracle GraalVM Enterprise Edition:22.1.0

10 vendors · 56 products