CVE-2022-21449

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Affected products

Vendor	Product	Affected	Fixed
Oracle	Java SE JDK and JRE	Oracle Java SE:17.0.2, Oracle Java SE:18, Oracle GraalVM Enterprise Edition:21.3.1, Oracle GraalVM Enterprise Edition:22.0.0.2	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	openjdk-17	17.0.3+7-1	—
Debian 11	openjdk-17	17.0.3+7-1~deb11u1	DSA-5128-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	openjdk-17	17.0.3+7-0ubuntu0.22.04.1	USN-5546-1, USN-5388-2
Ubuntu 22.04 LTS	openjdk-18	18.0.2+9-2~22.04	USN-5546-1
Ubuntu 22.04 LTS	openjdk-8	8u342-b07-0ubuntu1~22.04	USN-5546-1
Ubuntu 22.04 LTS	openjdk-lts	11.0.16+8-0ubuntu1~22.04	USN-5546-1
Ubuntu 20.04 LTS	openjdk-16	No fix yet	—
Ubuntu 20.04 LTS	openjdk-17	17.0.3+7-0ubuntu0.20.04.1	USN-5546-1, USN-5388-2
Ubuntu 20.04 LTS	openjdk-8	8u342-b07-0ubuntu1~20.04	USN-5546-1
Ubuntu 20.04 LTS	openjdk-lts	11.0.16+8-0ubuntu1~20.04	USN-5546-1
Ubuntu 18.04 LTS	openjdk-17	17.0.3+7-0ubuntu0.18.04.1	USN-5546-1, USN-5388-2
Ubuntu 18.04 LTS	openjdk-8	8u342-b07-0ubuntu1~18.04	USN-5546-1
Ubuntu 18.04 LTS	openjdk-lts	11.0.16+8-0ubuntu1~18.04	USN-5546-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	java-17-openjdk +22	1:17.0.3.0.7-1.el9_0	RHSA-2022:1729
RHEL 8	java-17-openjdk +22	1:17.0.3.0.6-2.el8_5	RHSA-2022:1445

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	java-17-openjdk +22	1:17.0.3.0.6-2.el8_5	ALSA-2022:1445

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	java-17-openjdk	1:17.0.3.0.6-2.el8_5	RLSA-2022:1445

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SLES 15 SP3	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SLES 15 SP2	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SLES 15 SP1	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SLES 15	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1

Show 16 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SLES 12 SP5	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SLES 12 SP4	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SLES 12 SP4	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SLES 12 SP3	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SLES 12 SP3	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SLES 12 SP2	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SLES 12 SP2	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SLES for SAP 15 SP2	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SLES for SAP 15 SP1	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SLES for SAP 15	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SLES for SAP 12 SP5	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SLES for SAP 12 SP5	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SLES for SAP 12 SP4	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SLES for SAP 12 SP4	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SUSE OpenStack Cloud Crowbar 9	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SUSE OpenStack Cloud Crowbar 9	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SUSE OpenStack Cloud 9	java-1_7_1-ibm	1.7.1_sr5.10-38.71.1	SUSE-SU-2022:2539-1
SUSE OpenStack Cloud 9	java-1_8_0-ibm	1.8.0_sr7.10-30.90.1	SUSE-SU-2022:2540-1
SUSE Manager Server 4.1	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SUSE Manager Retail Branch Server 4.1	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SUSE Manager Proxy 4.1	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SUSE Enterprise Storage 7	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
SUSE Enterprise Storage 6	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	java-15-openjdk	15.0.7.0-1.1	openSUSE-SU-2024:12014-1
openSUSE Tumbleweed	java-17-openjdk	17.0.3.0-1.1	openSUSE-SU-2024:12019-1
openSUSE Tumbleweed	java-18-openjdk	18.0.1.0-1.1	openSUSE-SU-2024:12015-1
openSUSE Leap 15.4	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1
openSUSE Leap 15.3	java-1_8_0-ibm	1.8.0_sr7.10-150000.3.59.1	SUSE-SU-2022:2650-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	openjdk17	17.0.3_p7-r0	—
Alpine v3.23	openjdk17	17.0.3_p7-r0	—
Alpine v3.22	openjdk17	17.0.3_p7-r0	—
Alpine v3.21	openjdk17	17.0.3_p7-r0	—
Alpine v3.20	openjdk17	17.0.3_p7-r0	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	openjdk17	17.0.3_p7-r0	—
Alpine v3.18	openjdk15	15.0.7_p4-r0	—
Alpine v3.18	openjdk17	17.0.3_p7-r0	—
Alpine v3.17	openjdk15	15.0.7_p4-r0	—
Alpine v3.17	openjdk17	17.0.3_p7-r0	—
Alpine v3.16	openjdk15	15.0.7_p4-r0	—
Alpine v3.16	openjdk17	17.0.3_p7-r0	—
Alpine v3.15	openjdk15	15.0.7_p4-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	java-17-amazon-corretto +4	1:17.0.3+6-1.amzn2.1	ALAS2-2022-1791

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	java-17-openjdk +22	1:17.0.3.0.7-1.el9_0	ELSA-2022-1729
Oracle Linux 8	java-17-openjdk +22	1:17.0.3.0.6-2.el8_5	ELSA-2022-1445

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	openjdk-15-jre +2	No fix yet	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 13 repositories · most starred shown

notkmhn/CVE-2022-21449-TLS-PoC ★ 121 · Apr 20, 2022

CVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server
jfrog/jfrog-CVE-2022-21449 ★ 37 · Apr 20, 2022
thack1/CVE-2022-21449 ★ 5 · Apr 24, 2022

Zeek script to detect exploitation attempts of CVE-2022-21449 targeting TLS clients
jmiettinen/CVE-2022-21449-vuln-test ★ 2 · Apr 20, 2022

CVE-2022-21449 Vulnerability tester
fevra-dev/ClaimJumper ★ 1 · Jan 16, 2026

Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist, and CVE-specific attacks (CVE-2022-21449, CVE-2018-0…
HeyMrSalt/AIS3-2024-Project-D5Team ★ 1 · Aug 1, 2024

Reappear-CVE-2022-21449-TLS-PoC
Skipper7718/CVE-2022-21449-showcase ★ 0 · Jul 29, 2022
fundaergn/CVE-2022-21449 ★ 0 · Jun 12, 2022

CVE 2022-21449
Damok82/SignChecker ★ 0 · Apr 25, 2022

Test tool to demonstrate the vulnerability of CVE-2022-21449
marschall/psychic-signatures ★ 0 · Apr 21, 2022

Demos the Psychic Signatures vulnerability (CVE-2022-21449)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 18

ALSA-2022:1445 Important: java-17-openjdk security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2022:1729 Red Hat Security Advisory: java-17-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2022:1445 Red Hat Security Advisory: java-17-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
USN-5546-1 openjdk-8, openjdk-lts, openjdk-17, openjdk-18 vulnerabilities Ubuntu Security Notices (USN) · May 29, 2026
USN-5388-2 openjdk-17 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-5128-1 openjdk-17 - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2022:1445 Important: java-17-openjdk security and bug fix update Rocky Linux Security Advisories · Feb 5, 2026
openSUSE-SU-2024:12014-1 java-15-openjdk-15.0.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2540-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2539-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12019-1 java-17-openjdk-17.0.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2650-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-1335 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
openSUSE-SU-2024:12015-1 java-18-openjdk-18.0.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
WID-SEC-2022-0200 Oracle Java SE und OpenJDK: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 18, 2025
ELSA-2022-1729 Important: java-17-openjdk security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 30, 2022
ALAS2-2022-1791 Important: java-17-amazon-corretto security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 27, 2022
ELSA-2022-1445 Important: java-17-openjdk security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 20, 2022

References

https://www.oracle.com/security-alerts/cpuapr2022.html
[oss-security] 20220428 CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting mailing-list
https://security.netapp.com/advisory/ntap-20220429-0006/
[oss-security] 20220429 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220501 Re: CVE-2022-21449 and version reporting mailing-list
[oss-security] 20220502 Re: CVE-2022-21449 and version reporting mailing-list
DSA-5128 vendor-advisory
DSA-5131 vendor-advisory

CNA	v3.1	7.5
EUVD	v3.1	7.5

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Oracle Linux

Wolfi

Public exploits

GitHub 13 repositories · most starred shown

Advisories 18

References