Skip to content
OpenAdvisories
Medium · 5.1 CVE-2023-22041 EUVD-2023-26206GHSA-rgxf-494f-377c

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspo…

Published Jul 18, 2023 · Updated May 28, 2026 · Assigned by oracle

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected products

VendorProductAffectedFixed
Oracle Java SE JDK and JRE Oracle Java SE:8u371-perf, Oracle Java SE:11.0.19, Oracle Java SE:17.0.7, Oracle Java SE:20.0.1, Oracle GraalVM Enterprise Edition:20.3.10, Oracle GraalVM Enterprise Edition:21.3.6, Oracle GraalVM Enterprise Edition:22.3.2, Oracle GraalVM for JDK:17.0.7, Oracle GraalVM for JDK:20.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 12 openjdk-17 17.0.8+7-1~deb12u1 DSA-5458-1
Debian 11 openjdk-11 11.0.20+8-1~deb11u1 DSA-5478-1
Debian 10 openjdk-11 11.0.20+8-1~deb10u1 DLA-3571-1
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS openjdk-17 17.0.8+7-1~22.04 USN-6263-1
Ubuntu 22.04 LTS openjdk-18 No fix yet —
Ubuntu 22.04 LTS openjdk-8 8u382-ga-1~22.04.1 USN-6263-1
Ubuntu 22.04 LTS openjdk-lts 11.0.20+8-1ubuntu1~22.04 USN-6263-1
Ubuntu 20.04 LTS openjdk-13 +1 No fix yet —
Ubuntu 20.04 LTS openjdk-17 17.0.8+7-1~20.04.2 USN-6263-1
Ubuntu 20.04 LTS openjdk-8 8u382-ga-1~20.04.1 USN-6263-1
Ubuntu 20.04 LTS openjdk-lts 11.0.20+8-1ubuntu1~20.04 USN-6263-1
Ubuntu 16.04 LTS openjdk-9 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS openjdk-17 17.0.8+7-1~18.04 USN-6263-1
Ubuntu Pro 18.04 LTS openjdk-8 8u382-ga-1~18.04.1 USN-6263-1
Ubuntu Pro 18.04 LTS openjdk-lts 11.0.20+8-1ubuntu1~18.04 USN-6263-1
Ubuntu Pro 16.04 LTS openjdk-8 8u382-ga-1~16.04.1 USN-6263-1
ReleasePackageFixed inAdvisory
RHEL 9 java-11-openjdk +22 1:11.0.20.0.8-2.el9 RHSA-2023:4158
RHEL 9 java-17-openjdk +22 1:17.0.8.0.7-2.el9 RHSA-2023:4177
RHEL 8 java-11-openjdk +22 1:11.0.20.0.8-2.el8 RHSA-2023:4175
RHEL 8 java-17-openjdk +22 1:17.0.8.0.7-2.el8 RHSA-2023:4159
RHEL 7 java-11-openjdk +8 1:11.0.20.0.8-1.el7_9 RHSA-2023:4233
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.0 EUS java-11-openjdk +22 1:11.0.20.0.8-1.el9_0 RHSA-2023:4157
RHEL 9.0 EUS java-17-openjdk +22 1:17.0.8.0.7-1.el9_0 RHSA-2023:4169
RHEL 8.6 EUS java-11-openjdk +22 1:11.0.20.0.8-1.el8_6 RHSA-2023:4164
RHEL 8.6 EUS java-17-openjdk +22 1:17.0.8.0.7-1.el8_6 RHSA-2023:4170
RHEL 8.4 TUS java-11-openjdk +8 1:11.0.20.0.8-1.el8_4 RHSA-2023:4163
RHEL 8.4 TUS java-17-openjdk +8 1:17.0.8.0.7-1.el8_4 RHSA-2023:4171
RHEL 8.4 E4S java-11-openjdk +8 1:11.0.20.0.8-1.el8_4 RHSA-2023:4163
RHEL 8.4 E4S java-17-openjdk +8 1:17.0.8.0.7-1.el8_4 RHSA-2023:4171
RHEL 8.4 AUS java-11-openjdk +8 1:11.0.20.0.8-1.el8_4 RHSA-2023:4163
RHEL 8.4 AUS java-17-openjdk +8 1:17.0.8.0.7-1.el8_4 RHSA-2023:4171
RHEL 8.2 TUS java-11-openjdk +8 1:11.0.20.0.8-1.el8_2 RHSA-2023:4162
RHEL 8.2 E4S java-11-openjdk +8 1:11.0.20.0.8-1.el8_2 RHSA-2023:4162
RHEL 8.2 AUS java-11-openjdk +8 1:11.0.20.0.8-1.el8_2 RHSA-2023:4162
RHEL 8.1 E4S java-11-openjdk +7 1:11.0.20.0.8-1.el8_1 RHSA-2023:4165

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 java-11-openjdk +22 1:11.0.20.0.8-2.el9 ALSA-2023:4158
AlmaLinux 9 java-17-openjdk +22 1:17.0.8.0.7-2.el9 ALSA-2023:4177
AlmaLinux 8 java-11-openjdk +22 1:11.0.20.0.8-2.el8 ALSA-2023:4175
AlmaLinux 8 java-17-openjdk +22 1:17.0.8.0.7-2.el8 ALSA-2023:4159
ReleasePackageFixed inAdvisory
SLES 15 SP5 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES 15 SP5 java-17-openjdk 17.0.8.0-150400.3.27.1 SUSE-SU-2023:3023-1
SLES 15 SP5 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLES 15 SP4 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES 15 SP4 java-17-openjdk 17.0.8.0-150400.3.27.1 SUSE-SU-2023:3023-1
SLES 15 SP4 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLES 15 SP3 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES 15 SP3 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLES 15 SP2 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES 15 SP2 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLES 15 SP1 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES 15 SP1 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 java-11-openjdk 11.0.20.0-3.61.1 SUSE-SU-2023:2990-1
SLES 12 SP5 java-1_8_0-ibm 1.8.0_sr8.10-30.114.1 SUSE-SU-2023:3406-1
SLES for SAP 15 SP3 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES for SAP 15 SP3 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLES for SAP 15 SP2 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES for SAP 15 SP2 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLES for SAP 15 SP1 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLES for SAP 15 SP1 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLES for SAP 12 SP5 java-11-openjdk 11.0.20.0-3.61.1 SUSE-SU-2023:2990-1
SLES for SAP 12 SP5 java-1_8_0-ibm 1.8.0_sr8.10-30.114.1 SUSE-SU-2023:3406-1
SLE HPC 15 SP3 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLE HPC 15 SP3 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SLE HPC 15 SP2 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SLE HPC 15 SP1 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SUSE Package Hub 15 SP6 java-11-openj9 11.0.26.0-bp156.4.3.1 openSUSE-SU-2025:0066-1
SUSE Package Hub 15 SP6 java-17-openj9 17.0.14.0-bp156.3.3.1 openSUSE-SU-2025:0067-1
SUSE Manager Server 4.2 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SUSE Manager Proxy 4.2 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SUSE Enterprise Storage 7.1 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
SUSE Enterprise Storage 7.1 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
SUSE Enterprise Storage 7 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openj9 +1 11.0.20.0-1.1 openSUSE-SU-2024:13130-1, openSUSE-SU-2024:13075-1
openSUSE Tumbleweed java-17-openj9 +1 17.0.8.0-1.1 openSUSE-SU-2024:13131-1, openSUSE-SU-2024:13076-1
openSUSE Leap 15.6 java-11-openj9 11.0.26.0-bp156.4.3.1 openSUSE-SU-2025:0066-1
openSUSE Leap 15.6 java-17-openj9 17.0.14.0-bp156.3.3.1 openSUSE-SU-2025:0067-1
openSUSE Leap 15.5 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
openSUSE Leap 15.5 java-17-openjdk 17.0.8.0-150400.3.27.1 SUSE-SU-2023:3023-1
openSUSE Leap 15.5 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
openSUSE Leap 15.4 java-11-openjdk 11.0.20.0-150000.3.99.1 SUSE-SU-2023:3287-1
openSUSE Leap 15.4 java-17-openjdk 17.0.8.0-150400.3.27.1 SUSE-SU-2023:3023-1
openSUSE Leap 15.4 java-1_8_0-ibm 1.8.0_sr8.10-150000.3.80.1 SUSE-SU-2023:3441-1
ReleasePackageFixed inAdvisory
Alpine v3.24 openjdk11 11.0.20_p8-r0 —
Alpine v3.24 openjdk17 17.0.8_p7-r0 —
Alpine v3.23 openjdk11 11.0.20_p8-r0 —
Alpine v3.23 openjdk17 17.0.8_p7-r0 —
Alpine v3.22 openjdk11 11.0.20_p8-r0 —
Alpine v3.22 openjdk17 17.0.8_p7-r0 —
Alpine v3.21 openjdk11 11.0.20_p8-r0 —
Alpine v3.21 openjdk17 17.0.8_p7-r0 —
Alpine v3.20 openjdk11 11.0.20_p8-r0 —
Alpine v3.20 openjdk17 17.0.8_p7-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 openjdk11 11.0.20_p8-r0 —
Alpine v3.19 openjdk17 17.0.8_p7-r0 —
Alpine v3.18 openjdk11 11.0.20_p8-r0 —
Alpine v3.18 openjdk17 17.0.8_p7-r0 —
Alpine v3.17 openjdk11 11.0.20_p8-r0 —
Alpine v3.17 openjdk17 17.0.8_p7-r0 —
Alpine v3.16 openjdk11 11.0.20_p8-r0 —
Alpine v3.16 openjdk17 17.0.8_p7-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 java-11-amazon-corretto +4 1:11.0.20+8-1.amzn2023 ALAS2023-2023-257
Amazon Linux 2023 java-17-amazon-corretto +4 1:17.0.8+7-1.amzn2023.1 ALAS2023-2023-258
Amazon Linux 2 java-11-amazon-corretto +2 1:11.0.20+8-1.amzn2 ALAS2-2023-2137
Amazon Linux 2 java-17-amazon-corretto +4 1:17.0.8+7-1.amzn2.1 ALAS2-2023-2138

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 java-11-openjdk +22 1:11.0.20.0.8-2.0.1.el9 ELSA-2023-4158
Oracle Linux 9 java-17-openjdk +22 1:17.0.8.0.7-2.0.1.el9 ELSA-2023-4177
Oracle Linux 8 java-11-openjdk +22 1:11.0.20.0.8-2.0.1.el8 ELSA-2023-4175
Oracle Linux 8 java-17-openjdk +22 1:17.0.8.0.7-2.0.1.el8 ELSA-2023-4159
Oracle Linux 7 java-11-openjdk +8 1:11.0.20.0.8-1.0.1.el7_9 ELSA-2023-4233

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling openjdk-15 15.0.10.5-r7 —
Wolfi rolling openjdk-16 16.0.2.7-r7 —
Wolfi rolling openjdk-19-jre 19.0.2.7-r6 —
Wolfi rolling openjdk-7-jre-lib No fix yet —

Advisories 44

References