GHSA-c9rv-f9qq-jjvf
Record from GitHub Advisory Database · Published May 24, 2022
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java). The supported version that is affected is 19.3.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition. Note: GraalVM Enterprise 19.3 and above includes both Java SE 8 and Java SE 11. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| openjdk-26-openj9 | Chainguard | 0.59.0-r1 |
| openjdk-8-openj9 | Chainguard | 0.53.0-r1 |
| openjdk-21-openj9 | Chainguard | 0.53.0-r0 |
| openjdk-11-openj9 | Chainguard | 0.53.0-r0 |
| openjdk-12 | Chainguard | 12.0.2.10-r10 |
| openjdk-25-openj9 | Chainguard | 0.59.0-r1 |
| openjdk-12 | Wolfi | 12.0.2.10-r10 |
| openjdk-17-openj9 | Chainguard | 0.53.0-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | openjdk-11 | * |
| wolfi | openjdk-11 | * |
| chainguard | openjdk-26-openj9 | 0 |
| chainguard | openjdk-8-openj9 | 0 |
| chainguard | openjdk-21-openj9 | 0 |
| chainguard | openjdk-11-openj9 | 0 |
| chainguard | openjdk-12 | 0 |
| chainguard | openjdk-25-openj9 | 0 |
| wolfi | openjdk-12 | 0 |
| chainguard | openjdk-17-openj9 | 0 |
Timeline
- May 24, 2022 CVE Published
- Apr 9, 2026 Distribution Patch (15 in total, the first dated here)
- Apr 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-c9rv-f9qq-jjvf
vulnetix vdb fixes GHSA-c9rv-f9qq-jjvfOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-c9rv-f9qq-jjvf/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-2604 advisory
- https://www.debian.org/security/2020/dsa-4605 url
- https://security.gentoo.org/glsa/202101-19 url
- https://kc.mcafee.com/corporate/index?page=content&id=SB10315 url
- https://access.redhat.com/errata/RHSA-2020:0468 url
- https://access.redhat.com/errata/RHSA-2020:0467 url
- https://access.redhat.com/errata/RHSA-2020:0196 url
- https://www.oracle.com/security-alerts/cpujul2021.html url
- https://usn.ubuntu.com/4257-1 url
- https://security.netapp.com/advisory/ntap-20200122-0003 url
- https://seclists.org/bugtraq/2020/Jan/24 url
- https://seclists.org/bugtraq/2020/Feb/22 url
- https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html url
- https://access.redhat.com/errata/RHSA-2020:0470 url
- https://access.redhat.com/errata/RHSA-2020:0469 url
- https://access.redhat.com/errata/RHSA-2020:0232 url
- https://access.redhat.com/errata/RHSA-2020:0122 url
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html url
- https://www.oracle.com/security-alerts/cpujan2020.html url
- https://www.debian.org/security/2020/dsa-4621 url
…and 7 more