High ELSA-2023-12936 5 CVEs

Important: GraalVM Security update (Oracle Linux 7)

Published Oct 24, 2023 · Updated Oct 24, 2023

Ecosystem: Oracle Linux

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 7	graalvm-community-21-jdk	0:21.0.1-1.el7
Oracle Linux · 7	graalvm-community-21-native-image	0:21.0.1-1.el7

Vulnerabilities 5

High 7.5

CVE-2023-30589

llhttp vulnerable to HTTP request smuggling

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…

Node.js node openjdk17 nodejs Debian Azure Linux Alpine Wolfi npm

Jun 30, 2023
Medium 5.3

CVE-2023-22067

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Su…

Oracle Java SE JDK and JRE openjdk-8 openjdk-9 Ubuntu Alpine Wolfi

Oct 17, 2023
Medium 5.3

CVE-2023-22081

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi

Oct 17, 2023
Unscored —

CVE-2023-30588

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…

Node.js node nodejs nodejs-20 Debian Wolfi

Nov 28, 2023
Unscored —

CVE-2023-30590

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…

Node.js node nodejs nodejs Debian Ubuntu Wolfi

Nov 28, 2023