CVE-2022-21476
📋 TL;DR
This vulnerability in Oracle Java SE and GraalVM Enterprise Edition allows unauthenticated remote attackers to access sensitive data from Java applications. It affects Java deployments running sandboxed Web Start applications or applets that load untrusted code from the internet. The vulnerability can be exploited via network protocols without user interaction.
💻 Affected Systems
- Oracle Java SE
- Oracle GraalVM Enterprise Edition
📦 What is this software?
E Series Santricity Os Controller by Netapp
E Series Santricity Storage Manager by Netapp
View all CVEs affecting E Series Santricity Storage Manager →
E Series Santricity Web Services by Netapp
Graalvm by Oracle
Graalvm by Oracle
Graalvm by Oracle
Jdk by Oracle
Jdk by Oracle
Jdk by Oracle
Jdk by Oracle
Jdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Solidfire by Netapp
Zulu by Azul
Zulu by Azul
Zulu by Azul
Zulu by Azul
Zulu by Azul
Zulu by Azul
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all accessible data in vulnerable Java deployments, potentially exposing sensitive information like credentials, personal data, or proprietary information.
Likely Case
Unauthorized access to application data in internet-facing Java applications, particularly those running untrusted code in sandboxed environments.
If Mitigated
Limited impact if applications don't load untrusted code or if network access to vulnerable services is restricted.
🎯 Exploit Status
CVSS indicates low attack complexity and no authentication required. Multiple protocols can be used for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Java SE: 7u341, 8u331, 11.0.15, 17.0.3, 18.0.1; GraalVM: 20.3.6, 21.3.2, 22.0.0.3
Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2022.html
Restart Required: Yes
Instructions:
1. Download latest Java version from Oracle. 2. Uninstall affected Java versions. 3. Install patched version. 4. Restart affected applications/services.
🔧 Temporary Workarounds
Disable Java Web Start/Applets
allPrevent execution of sandboxed Java applications that load untrusted code
For browsers: Disable Java plugin
System-wide: Remove Java browser integration
Network Segmentation
allRestrict network access to Java applications
firewall rules to limit inbound connections to Java services
🧯 If You Can't Patch
- Disable Java Web Start and applet functionality entirely
- Implement strict network controls to limit access to Java applications
🔍 How to Verify
Check if Vulnerable:
Check Java version with 'java -version' and compare against affected versionsCheck Version:
java -versionVerify Fix Applied:
Verify installed Java version is equal to or higher than patched versions listed in fix_official📡 Detection & Monitoring
Log Indicators:
- Unusual Java process activity
- Multiple failed data access attempts in Java applications
Network Indicators:
- Unexpected network connections to Java services
- Traffic patterns matching Java RMI or other Java protocols
SIEM Query:
source="java" AND (event_type="security_violation" OR event_type="data_access")🔗 References
- https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html
- https://security.netapp.com/advisory/ntap-20220429-0006/
- https://www.debian.org/security/2022/dsa-5128
- https://www.debian.org/security/2022/dsa-5131
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html
- https://security.netapp.com/advisory/ntap-20220429-0006/
- https://www.debian.org/security/2022/dsa-5128
- https://www.debian.org/security/2022/dsa-5131
- https://www.oracle.com/security-alerts/cpuapr2022.html
