Important: GraalVM Security update (Oracle Linux 7)

Fixed packages 21

Vulnerabilities 14

• Critical 9.1
  CVE-2022-32213 EPSS 45%

  llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• Critical 9.1
  CVE-2022-32214 EPSS 82%

  llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• Critical 9.1
  CVE-2022-35255

  A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…

  Node.js node nodejs nodejs Debian Alpine
  Dec 5, 2022
• High 7.5
  CVE-2022-2097 Public exploit

  AES OCB fails to encrypt some bytes

  AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io
  Jul 5, 2022
• Medium 6.5
  CVE-2022-35256

  The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 5, 2022
• Medium 5.3
  CVE-2022-21618

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Sup…

  Oracle Java SE JDK and JRE openjdk-lts openjdk-9 Debian Ubuntu Alpine Wolfi
  Oct 18, 2022
• Medium 5.3
  CVE-2022-21626

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…

  Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Oct 18, 2022
• Medium 5.3
  CVE-2022-21628

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweigh…

  Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Oct 18, 2022
• Low 3.7
  CVE-2022-21619

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…

  Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Oct 18, 2022
• Low 3.7
  CVE-2022-21624

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Sup…

  Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Oct 18, 2022
• Low 3.7
  CVE-2022-39399

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking…

  Oracle Java SE JDK and JRE openjdk-lts openjdk-9 Debian Ubuntu Alpine Wolfi
  Oct 18, 2022
• Unscored —
  CVE-2022-32212

  A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022
• Unscored —
  CVE-2022-32215 EPSS 70%

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022
• Unscored —
  CVE-2022-32222

  A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default p…

  Node.js node nodejs-current Alpine
  Jul 14, 2022