Important: GraalVM Security update (Oracle Linux 7)

Fixed packages 14

Vulnerabilities 5

• High 7.7
  CVE-2022-25647 EPSS 12%

  Deserialization of Untrusted Data

  The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

  openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven
  May 1, 2022
• High 7.5
  CVE-2022-34169 Public exploit EPSS 82%

  Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

  The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

  Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  Jul 19, 2022
• Medium 5.9
  CVE-2022-21541

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …

  Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Jul 19, 2022
• Medium 5.3
  CVE-2022-21540

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …

  Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Jul 19, 2022
• Medium 5.3
  CVE-2022-21549

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…

  Oracle Java SE JDK and JRE openjdk-lts openjdk-9 Debian Ubuntu Alpine Wolfi
  Jul 19, 2022