VDB
BDU%3A2022-02516
BDU%3A2022-02516
PUBLISHED
CVSS 10 CRITICAL
Уязвимость реализации алгоритма цифровой подписи ECDSA программной платформы Oracle Java SE и виртуальной машины Oracle GraalVM Enterprise Edition, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность информации
Risk Scores
CVSS 2.0
10
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat Inc., Oracle Corp., IBM Corp., Axiom JDK | Red Hat Enterprise Linux, Red Hat build of OpenJDK, Java SE, GraalVM Enterprise Edition, IBM Cloud Object Storage Systems, Axiom AxiomJDK |
Timeline
- Apr 22, 2022 CVE Published
- Apr 22, 2022 PoC Published
- Feb 7, 2024 CVE Updated
References
- https://www.oracle.com/security-alerts/cpuapr2022.html url
- https://github.com/khalednassar/CVE-2022-21449-TLS-PoC url
- https://jfrog.com/blog/cve-2022-21449-psychic-signatures-analyzing-the-new-java-crypto-vulnerability/ url
- https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/ url
- https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/04/oracle-releases-massive-critical-patch-update-containing-520-security-patches/ url
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-with-openjdk-gnutls-affect-ibm-cloud-object-storage-systems-august-2022v1/ url
- https://axiomjdk.ru/blog/ url
- https://access.redhat.com/security/cve/cve-2022-21449 advisory