VAR-202204-0593
Vulnerability from variot - Updated: 2026-03-09 20:58Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2022-21443). Bugs fixed (https://bugzilla.redhat.com/):
2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2031958 - CVE-2021-43797 netty: control chars in header names may lead to HTTP request smuggling 2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter 2058404 - CVE-2022-0759 kubeclient: kubeconfig parsing error can lead to MITM attacks
- JIRA issues fixed (https://issues.jboss.org/):
LOG-2334 - [release-5.3] Events listing out of order in Kibana 6.8.1 LOG-2450 - http.max_header_size set to 128kb causes communication with elasticsearch to stop working LOG-2481 - EO shouldn't grant cluster-wide permission to system:serviceaccount:openshift-monitoring:prometheus-k8s when ES cluster is deployed. [openshift-logging 5.3]
- ========================================================================= Ubuntu Security Notice USN-5546-1 August 04, 2022
openjdk-8, openjdk-lts, openjdk-17, openjdk-18 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in OpenJDK.
Software Description: - openjdk-17: Open Source Java implementation - openjdk-18: Open Source Java implementation - openjdk-8: Open Source Java implementation - openjdk-lts: Open Source Java implementation
Details:
Neil Madden discovered that OpenJDK did not properly verify ECDSA signatures. A remote attacker could possibly use this issue to insert, edit or obtain sensitive information. This issue only affected OpenJDK 17 and OpenJDK 18. (CVE-2022-21449)
It was discovered that OpenJDK incorrectly limited memory when compiling a specially crafted XPath expression. An attacker could possibly use this issue to cause a denial of service. This issue was fixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21426)
It was discovered that OpenJDK incorrectly handled converting certain object arguments into their textual representations. An attacker could possibly use this issue to cause a denial of service. This issue was fixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21434)
It was discovered that OpenJDK incorrectly validated the encoded length of certain object identifiers. An attacker could possibly use this issue to cause a denial of service. This issue was fixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21443)
It was discovered that OpenJDK incorrectly validated certain paths. An attacker could possibly use this issue to bypass the secure validation feature and expose sensitive information in XML files. This issue was fixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21476)
It was discovered that OpenJDK incorrectly parsed certain URI strings. An attacker could possibly use this issue to make applications accept invalid of malformed URI strings. This issue was fixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21496)
It was discovered that OpenJDK incorrectly generated class code in the Hotspot component. An attacker could possibly use this issue to obtain sensitive information. (CVE-2022-21540)
It was dicovered that OpenJDK incorrectly restricted access to the invokeBasic() method in the Hotspot component. An attacker could possibly use this issue to insert, edit or obtain sensitive information. (CVE-2022-21541)
It was discovered that OpenJDK incorrectly computed exponentials. An attacker could possibly use this issue to insert, edit or obtain sensitive information. This issue only affected OpenJDK 17. (CVE-2022-21549)
It was discovered that OpenJDK includes a copy of Xalan that incorrectly handled integer truncation. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-34169)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04 LTS: openjdk-11-jdk 11.0.16+8-0ubuntu1~22.04 openjdk-11-jre 11.0.16+8-0ubuntu1~22.04 openjdk-11-jre-headless 11.0.16+8-0ubuntu1~22.04 openjdk-11-jre-zero 11.0.16+8-0ubuntu1~22.04 openjdk-17-jdk 17.0.4+8-1~22.04 openjdk-17-jre 17.0.4+8-1~22.04 openjdk-17-jre-headless 17.0.4+8-1~22.04 openjdk-17-jre-zero 17.0.4+8-1~22.04 openjdk-18-jdk 18.0.2+9-2~22.04 openjdk-18-jre 18.0.2+9-2~22.04 openjdk-18-jre-headless 18.0.2+9-2~22.04 openjdk-18-jre-zero 18.0.2+9-2~22.04 openjdk-8-jdk 8u342-b07-0ubuntu1~22.04 openjdk-8-jre 8u342-b07-0ubuntu1~22.04 openjdk-8-jre-headless 8u342-b07-0ubuntu1~22.04 openjdk-8-jre-zero 8u342-b07-0ubuntu1~22.04
Ubuntu 20.04 LTS: openjdk-11-jdk 11.0.16+8-0ubuntu1~20.04 openjdk-11-jre 11.0.16+8-0ubuntu1~20.04 openjdk-11-jre-headless 11.0.16+8-0ubuntu1~20.04 openjdk-11-jre-zero 11.0.16+8-0ubuntu1~20.04 openjdk-17-jdk 17.0.4+8-1~20.04 openjdk-17-jre 17.0.4+8-1~20.04 openjdk-17-jre-headless 17.0.4+8-1~20.04 openjdk-17-jre-zero 17.0.4+8-1~20.04 openjdk-8-jdk 8u342-b07-0ubuntu1~20.04 openjdk-8-jre 8u342-b07-0ubuntu1~20.04 openjdk-8-jre-headless 8u342-b07-0ubuntu1~20.04 openjdk-8-jre-zero 8u342-b07-0ubuntu1~20.04
Ubuntu 18.04 LTS: openjdk-11-jdk 11.0.16+8-0ubuntu1~18.04 openjdk-11-jre 11.0.16+8-0ubuntu1~18.04 openjdk-11-jre-headless 11.0.16+8-0ubuntu1~18.04 openjdk-11-jre-zero 11.0.16+8-0ubuntu1~18.04 openjdk-17-jdk 17.0.4+8-1~18.04 openjdk-17-jre 17.0.4+8-1~18.04 openjdk-17-jre-headless 17.0.4+8-1~18.04 openjdk-17-jre-zero 17.0.4+8-1~18.04 openjdk-8-jdk 8u342-b07-0ubuntu1~18.04 openjdk-8-jre 8u342-b07-0ubuntu1~18.04 openjdk-8-jre-headless 8u342-b07-0ubuntu1~18.04 openjdk-8-jre-zero 8u342-b07-0ubuntu1~18.04
This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-5546-1 CVE-2022-21426, CVE-2022-21434, CVE-2022-21443, CVE-2022-21449, CVE-2022-21476, CVE-2022-21496, CVE-2022-21540, CVE-2022-21541, CVE-2022-21549, CVE-2022-34169
Package Information: https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~22.04 https://launchpad.net/ubuntu/+source/openjdk-18/18.0.2+9-2~22.04 https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~22.04 https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~22.04 https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~20.04 https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~20.04 https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~20.04 https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~18.04 https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~18.04 https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~18.04 . This release includes security and bug fixes and enhancements.
For more information, see the documentation linked in the Solution section. Bugs fixed (https://bugzilla.redhat.com/):
2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table command can cause panic 2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty string
- References:
https://access.redhat.com/security/cve/CVE-2018-25032 https://access.redhat.com/security/cve/CVE-2021-3999 https://access.redhat.com/security/cve/CVE-2021-23177 https://access.redhat.com/security/cve/CVE-2021-31566 https://access.redhat.com/security/cve/CVE-2021-41771 https://access.redhat.com/security/cve/CVE-2021-41772 https://access.redhat.com/security/cve/CVE-2021-45960 https://access.redhat.com/security/cve/CVE-2021-46143 https://access.redhat.com/security/cve/CVE-2022-0778 https://access.redhat.com/security/cve/CVE-2022-21426 https://access.redhat.com/security/cve/CVE-2022-21434 https://access.redhat.com/security/cve/CVE-2022-21443 https://access.redhat.com/security/cve/CVE-2022-21449 https://access.redhat.com/security/cve/CVE-2022-21476 https://access.redhat.com/security/cve/CVE-2022-21496 https://access.redhat.com/security/cve/CVE-2022-22822 https://access.redhat.com/security/cve/CVE-2022-22823 https://access.redhat.com/security/cve/CVE-2022-22824 https://access.redhat.com/security/cve/CVE-2022-22825 https://access.redhat.com/security/cve/CVE-2022-22826 https://access.redhat.com/security/cve/CVE-2022-22827 https://access.redhat.com/security/cve/CVE-2022-23218 https://access.redhat.com/security/cve/CVE-2022-23219 https://access.redhat.com/security/cve/CVE-2022-23308 https://access.redhat.com/security/cve/CVE-2022-23852 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 For details about the security issues see these CVE pages: * https://access.redhat.com/security/updates/classification/#low * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
For the oldstable distribution (buster), this problem has been fixed in version 11.0.15+10-1~deb10u1.
For the stable distribution (bullseye), this problem has been fixed in version 11.0.15+10-1~deb11u1.
We recommend that you upgrade your openjdk-11 packages.
For the detailed security status of openjdk-11 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openjdk-11
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmJz7AUACgkQEMKTtsN8 TjYPqQ//acxZ7tw58VvpicLhG3iTGRpUcVEVZwCcs1EGSs5sBAT20Q/rvZNc932o //8ipzrsv1pZX4txFzDi9gI279f27RTIhb+vJCWblPoRt7rXVkB7N5TR0UT4IurP ZCDcKF0PaStHPPrD7ZvVVUSQU09cDvHb0ibNnuXguOLCji9sIaPoubIAJ+NAkMIM 54inl1f4FQSwf1yqvZbjlnSvsDmBQ7nGE//yyajhN+JY29SkZdseLRgkAtGsG9+G 8XshJHdAGSuIeCUpJzbcYFdeikwXzQNP0DhvBGyClNmYUS/C4w9KCo8ab6L1rWhQ vnVDIAdX4zH+GTxtZ7xuelNvYUwiTW4DhYHtEoU8UvrhzJJ0ZtidAdEhoLlxJkdK e767zzyHFx9qbd5UFgwn8XMoJKlkkJtThTARypBcbN7mq9j7bxGV0JGTm1K76KJp j2lIau4swGGkFWD2kTLVO5O/chj5l4gsxX2Mi9ipLiBeD2TVTwY/MV1iX5q4EVMg 3Kt4ZSw2AxgwCPzaaSTBpkRcwJyspsAzIQfkmhnJ170v9iUsf5hg3oJV+Mhxqm/F znuzj1FKQ++A50O+6fGPA48T2DRATM7BMGBbjzWjRJ7KEptHEFnBGdkCU33I0YSm MIYXEATq5Z7D5g5SX2WZLOReTr7Y/PLCd6FRZGcFvbs5zjcKSGM= =Ysyl -----END PGP SIGNATURE----- . To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
- Solution:
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html
Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
- Bugs fixed (https://bugzilla.redhat.com/):
2066837 - CVE-2022-24769 moby: Default inheritable capabilities for linux container should be empty 2081642 - Placeholder bug for OCP 4.7.0 extras release
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: java-1.8.0-ibm security update Advisory ID: RHSA-2023:3136-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://access.redhat.com/errata/RHSA-2023:3136 Issue date: 2023-05-16 CVE Names: CVE-2022-21426 CVE-2023-21830 CVE-2023-21843 ==================================================================== 1. Summary:
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 7 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64
- Description:
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
Security Fix(es):
-
OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) (CVE-2022-21426)
-
OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830)
-
OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
2075788 - CVE-2022-21426 OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) 2160475 - CVE-2023-21843 OpenJDK: soundbank URL remote loading (Sound, 8293742) 2160490 - CVE-2023-21830 OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021)
- Package List:
Red Hat Enterprise Linux Client Supplementary (v. 7):
x86_64: java-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):
x86_64: java-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 7):
ppc64: java-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.ppc64.rpm
ppc64le: java-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm
s390x: java-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.s390x.rpm
x86_64: java-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 7):
x86_64: java-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBZGQXddzjgjWX9erEAQjtrg//WDCW8/RkoEyTvEChqF7uHnK4V3rBSk9+ ubpNx/M2kajuILXohNxBY4tcm3jyvoL6gwwCQ3iMlWA369AHI7DturxjJQr3GziD pbyWqMR4sIyAKJpf32a4MlUBAg01jby2PCxeiD4Llw1Gf2U/BRsDalXoVz/s7dhB jCO3qNpIbZNmg8gG7jbWbgtCMreM17sONQdWCg5sgfRAKakgcH8xMCWpb02tmLCR gS7f4m24sLDhSvWQGxkhkXwhpiG5wGIYnFaS7cQzdHpHS37qOVGshTpgJEsI9c0S zTfYYkpCJivl/aENlnYKpVgHmSPP9Qxo0TO18A8y53bJXJBLNBjw6fjDkJLcfOuI jwHGNnbR1vAhQieD5ACT7rTADBx8fsv2EAqgvGgopuuOPHSKQYxQgCBQu/ZqBf02 1n3cw0OieNoqW7HqW4qrTkYxma9L5WxfAPTgZhN0OUiWMgLfNtQjuRoSHKGNtwAk //tqVreuJPxNGBajdvXEhDLxuBeLiUnxvkgLgaZ+J39MeI3pV5XPbR1qswy7Nsor 4L+ulZussEs8yZfPzhBMfyARuOGBFX07Cfy1cT381KsisjoUK6OsKnByO/tsOa7d nrm/7B+ANBS59mTjRDKtE4/cdVIwvn9qt9/zg8kSUS1x7CjaQ2qyLbTczKyFRiSK QcLjOlHi3+I=ckJc -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Summary:
Security updated rh-sso-7/sso75-openshift-rhel8 container image is now available for RHEL-8 based Middleware Containers. Description:
The rh-sso-7/sso75-openshift-rhel8 container image has been updated for RHEL-8 based Middleware Containers to include the following security issues.
Users of rh-sso-7/sso75-openshift-rhel8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.
You can find images updated by this advisory in Red Hat Container Catalog (see References). Solution:
The RHEL-8 based Middleware Containers container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com.
Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally. Bugs fixed (https://bugzilla.redhat.com/):
2071036 - CVE-2022-1245 keycloak: Privilege escalation vulnerability on Token Exchange
5
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "jre",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "18"
},
{
"_id": null,
"model": "jdk",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "1.8.0"
},
{
"_id": null,
"model": "santricity unified manager",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "17.32"
},
{
"_id": null,
"model": "cloud insights acquisition unit",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "jdk",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "11.0.14"
},
{
"_id": null,
"model": "solidfire\\, enterprise sds \\\u0026 hci storage node",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "jdk",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "17.0.2"
},
{
"_id": null,
"model": "graalvm",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "22.0.0.2"
},
{
"_id": null,
"model": "cloud secure agent",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "11.0"
},
{
"_id": null,
"model": "e-series santricity storage manager",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "11.54"
},
{
"_id": null,
"model": "7-mode transition tool",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"_id": null,
"model": "solidfire \\\u0026 hci management node",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "15.38"
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "13.46"
},
{
"_id": null,
"model": "active iq unified manager",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "jre",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "1.7.0"
},
{
"_id": null,
"model": "jdk",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "18"
},
{
"_id": null,
"model": "graalvm",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "20.3.5"
},
{
"_id": null,
"model": "graalvm",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "21.3.1"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"_id": null,
"model": "e-series santricity os controller",
"scope": "lte",
"trust": 1.0,
"vendor": "netapp",
"version": "11.70.1"
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "6.45"
},
{
"_id": null,
"model": "jre",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "11.0.14"
},
{
"_id": null,
"model": "e-series santricity web services",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "jre",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "1.8.0"
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "18.28"
},
{
"_id": null,
"model": "oncommand insight",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "jdk",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "1.7.0"
},
{
"_id": null,
"model": "jre",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "17.0.2"
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "7.52"
},
{
"_id": null,
"model": "hci compute node",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "e-series santricity os controller",
"scope": "gte",
"trust": 1.0,
"vendor": "netapp",
"version": "11.0.0"
},
{
"_id": null,
"model": "zulu",
"scope": "eq",
"trust": 1.0,
"vendor": "azul",
"version": "8.60"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21426"
}
]
},
"credits": {
"_id": null,
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "167140"
},
{
"db": "PACKETSTORM",
"id": "167122"
},
{
"db": "PACKETSTORM",
"id": "167008"
},
{
"db": "PACKETSTORM",
"id": "167164"
},
{
"db": "PACKETSTORM",
"id": "172404"
},
{
"db": "PACKETSTORM",
"id": "166967"
}
],
"trust": 0.6
},
"cve": "CVE-2022-21426",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2022-21426",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.1,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-407039",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "secalert_us@oracle.com",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2022-21426",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-21426",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "secalert_us@oracle.com",
"id": "CVE-2022-21426",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-407039",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2022-21426",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-407039"
},
{
"db": "VULMON",
"id": "CVE-2022-21426"
},
{
"db": "NVD",
"id": "CVE-2022-21426"
},
{
"db": "NVD",
"id": "CVE-2022-21426"
}
]
},
"description": {
"_id": null,
"data": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2022-21443). Bugs fixed (https://bugzilla.redhat.com/):\n\n2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data\n2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way\n2031958 - CVE-2021-43797 netty: control chars in header names may lead to HTTP request smuggling\n2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter\n2058404 - CVE-2022-0759 kubeclient: kubeconfig parsing error can lead to MITM attacks\n\n5. JIRA issues fixed (https://issues.jboss.org/):\n\nLOG-2334 - [release-5.3] Events listing out of order in Kibana 6.8.1\nLOG-2450 - http.max_header_size set to 128kb causes communication with elasticsearch to stop working\nLOG-2481 - EO shouldn\u0027t grant cluster-wide permission to system:serviceaccount:openshift-monitoring:prometheus-k8s when ES cluster is deployed. [openshift-logging 5.3]\n\n6. =========================================================================\nUbuntu Security Notice USN-5546-1\nAugust 04, 2022\n\nopenjdk-8, openjdk-lts, openjdk-17, openjdk-18 vulnerabilities\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 22.04 LTS\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in OpenJDK. \n\nSoftware Description:\n- openjdk-17: Open Source Java implementation\n- openjdk-18: Open Source Java implementation\n- openjdk-8: Open Source Java implementation\n- openjdk-lts: Open Source Java implementation\n\nDetails:\n\nNeil Madden discovered that OpenJDK did not properly verify ECDSA\nsignatures. A remote attacker could possibly use this issue to insert,\nedit or obtain sensitive information. This issue only affected OpenJDK\n17 and OpenJDK 18. (CVE-2022-21449)\n\nIt was discovered that OpenJDK incorrectly limited memory when compiling a\nspecially crafted XPath expression. An attacker could possibly use this\nissue to cause a denial of service. This issue was fixed in OpenJDK 8 and\nOpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11\nand OpenJDK 17. (CVE-2022-21426)\n\nIt was discovered that OpenJDK incorrectly handled converting certain\nobject arguments into their textual representations. An attacker could\npossibly use this issue to cause a denial of service. This issue was\nfixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed\nthis issue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21434)\n\nIt was discovered that OpenJDK incorrectly validated the encoded length of\ncertain object identifiers. An attacker could possibly use this issue to\ncause a denial of service. This issue was fixed in OpenJDK 8 and OpenJDK 18. \nUSN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11 and OpenJDK 17. \n(CVE-2022-21443)\n\nIt was discovered that OpenJDK incorrectly validated certain paths. An\nattacker could possibly use this issue to bypass the secure validation\nfeature and expose sensitive information in XML files. This issue was\nfixed in OpenJDK 8 and OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this\nissue in OpenJDK 11 and OpenJDK 17. (CVE-2022-21476)\n\nIt was discovered that OpenJDK incorrectly parsed certain URI strings. An\nattacker could possibly use this issue to make applications accept\ninvalid of malformed URI strings. This issue was fixed in OpenJDK 8 and\nOpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11\nand OpenJDK 17. (CVE-2022-21496)\n\nIt was discovered that OpenJDK incorrectly generated class code in the\nHotspot component. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-21540)\n\nIt was dicovered that OpenJDK incorrectly restricted access to the\ninvokeBasic() method in the Hotspot component. An attacker could possibly\nuse this issue to insert, edit or obtain sensitive information. \n(CVE-2022-21541)\n\nIt was discovered that OpenJDK incorrectly computed exponentials. An\nattacker could possibly use this issue to insert, edit or obtain sensitive\ninformation. This issue only affected OpenJDK 17. \n(CVE-2022-21549)\n\nIt was discovered that OpenJDK includes a copy of Xalan that incorrectly\nhandled integer truncation. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2022-34169)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 22.04 LTS:\n openjdk-11-jdk 11.0.16+8-0ubuntu1~22.04\n openjdk-11-jre 11.0.16+8-0ubuntu1~22.04\n openjdk-11-jre-headless 11.0.16+8-0ubuntu1~22.04\n openjdk-11-jre-zero 11.0.16+8-0ubuntu1~22.04\n openjdk-17-jdk 17.0.4+8-1~22.04\n openjdk-17-jre 17.0.4+8-1~22.04\n openjdk-17-jre-headless 17.0.4+8-1~22.04\n openjdk-17-jre-zero 17.0.4+8-1~22.04\n openjdk-18-jdk 18.0.2+9-2~22.04\n openjdk-18-jre 18.0.2+9-2~22.04\n openjdk-18-jre-headless 18.0.2+9-2~22.04\n openjdk-18-jre-zero 18.0.2+9-2~22.04\n openjdk-8-jdk 8u342-b07-0ubuntu1~22.04\n openjdk-8-jre 8u342-b07-0ubuntu1~22.04\n openjdk-8-jre-headless 8u342-b07-0ubuntu1~22.04\n openjdk-8-jre-zero 8u342-b07-0ubuntu1~22.04\n\nUbuntu 20.04 LTS:\n openjdk-11-jdk 11.0.16+8-0ubuntu1~20.04\n openjdk-11-jre 11.0.16+8-0ubuntu1~20.04\n openjdk-11-jre-headless 11.0.16+8-0ubuntu1~20.04\n openjdk-11-jre-zero 11.0.16+8-0ubuntu1~20.04\n openjdk-17-jdk 17.0.4+8-1~20.04\n openjdk-17-jre 17.0.4+8-1~20.04\n openjdk-17-jre-headless 17.0.4+8-1~20.04\n openjdk-17-jre-zero 17.0.4+8-1~20.04\n openjdk-8-jdk 8u342-b07-0ubuntu1~20.04\n openjdk-8-jre 8u342-b07-0ubuntu1~20.04\n openjdk-8-jre-headless 8u342-b07-0ubuntu1~20.04\n openjdk-8-jre-zero 8u342-b07-0ubuntu1~20.04\n\nUbuntu 18.04 LTS:\n openjdk-11-jdk 11.0.16+8-0ubuntu1~18.04\n openjdk-11-jre 11.0.16+8-0ubuntu1~18.04\n openjdk-11-jre-headless 11.0.16+8-0ubuntu1~18.04\n openjdk-11-jre-zero 11.0.16+8-0ubuntu1~18.04\n openjdk-17-jdk 17.0.4+8-1~18.04\n openjdk-17-jre 17.0.4+8-1~18.04\n openjdk-17-jre-headless 17.0.4+8-1~18.04\n openjdk-17-jre-zero 17.0.4+8-1~18.04\n openjdk-8-jdk 8u342-b07-0ubuntu1~18.04\n openjdk-8-jre 8u342-b07-0ubuntu1~18.04\n openjdk-8-jre-headless 8u342-b07-0ubuntu1~18.04\n openjdk-8-jre-zero 8u342-b07-0ubuntu1~18.04\n\nThis update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes. \n\nReferences:\n https://ubuntu.com/security/notices/USN-5546-1\n CVE-2022-21426, CVE-2022-21434, CVE-2022-21443, CVE-2022-21449,\n CVE-2022-21476, CVE-2022-21496, CVE-2022-21540, CVE-2022-21541,\n CVE-2022-21549, CVE-2022-34169\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~22.04\n https://launchpad.net/ubuntu/+source/openjdk-18/18.0.2+9-2~22.04\n https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~22.04\n https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~22.04\n https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~20.04\n https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~20.04\n https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~20.04\n https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~18.04\n https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~18.04\n https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~18.04\n. This\nrelease includes security and bug fixes and enhancements. \n\nFor more information, see the documentation linked in the Solution section. Bugs fixed (https://bugzilla.redhat.com/):\n\n2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table command can cause panic\n2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty string\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-25032\nhttps://access.redhat.com/security/cve/CVE-2021-3999\nhttps://access.redhat.com/security/cve/CVE-2021-23177\nhttps://access.redhat.com/security/cve/CVE-2021-31566\nhttps://access.redhat.com/security/cve/CVE-2021-41771\nhttps://access.redhat.com/security/cve/CVE-2021-41772\nhttps://access.redhat.com/security/cve/CVE-2021-45960\nhttps://access.redhat.com/security/cve/CVE-2021-46143\nhttps://access.redhat.com/security/cve/CVE-2022-0778\nhttps://access.redhat.com/security/cve/CVE-2022-21426\nhttps://access.redhat.com/security/cve/CVE-2022-21434\nhttps://access.redhat.com/security/cve/CVE-2022-21443\nhttps://access.redhat.com/security/cve/CVE-2022-21449\nhttps://access.redhat.com/security/cve/CVE-2022-21476\nhttps://access.redhat.com/security/cve/CVE-2022-21496\nhttps://access.redhat.com/security/cve/CVE-2022-22822\nhttps://access.redhat.com/security/cve/CVE-2022-22823\nhttps://access.redhat.com/security/cve/CVE-2022-22824\nhttps://access.redhat.com/security/cve/CVE-2022-22825\nhttps://access.redhat.com/security/cve/CVE-2022-22826\nhttps://access.redhat.com/security/cve/CVE-2022-22827\nhttps://access.redhat.com/security/cve/CVE-2022-23218\nhttps://access.redhat.com/security/cve/CVE-2022-23219\nhttps://access.redhat.com/security/cve/CVE-2022-23308\nhttps://access.redhat.com/security/cve/CVE-2022-23852\nhttps://access.redhat.com/security/cve/CVE-2022-25235\nhttps://access.redhat.com/security/cve/CVE-2022-25236\nhttps://access.redhat.com/security/cve/CVE-2022-25315\nFor\ndetails\nabout\nthe\nsecurity\nissues\nsee\nthese\nCVE\npages:\n*\nhttps://access.redhat.com/security/updates/classification/#low\n*\nhttps://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index\n*\nhttps://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index\n*\nhttps://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index\n*\nhttps://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index\n*\nhttps://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index\n\n6. \n\nFor the oldstable distribution (buster), this problem has been fixed\nin version 11.0.15+10-1~deb10u1. \n\nFor the stable distribution (bullseye), this problem has been fixed in\nversion 11.0.15+10-1~deb11u1. \n\nWe recommend that you upgrade your openjdk-11 packages. \n\nFor the detailed security status of openjdk-11 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/openjdk-11\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmJz7AUACgkQEMKTtsN8\nTjYPqQ//acxZ7tw58VvpicLhG3iTGRpUcVEVZwCcs1EGSs5sBAT20Q/rvZNc932o\n//8ipzrsv1pZX4txFzDi9gI279f27RTIhb+vJCWblPoRt7rXVkB7N5TR0UT4IurP\nZCDcKF0PaStHPPrD7ZvVVUSQU09cDvHb0ibNnuXguOLCji9sIaPoubIAJ+NAkMIM\n54inl1f4FQSwf1yqvZbjlnSvsDmBQ7nGE//yyajhN+JY29SkZdseLRgkAtGsG9+G\n8XshJHdAGSuIeCUpJzbcYFdeikwXzQNP0DhvBGyClNmYUS/C4w9KCo8ab6L1rWhQ\nvnVDIAdX4zH+GTxtZ7xuelNvYUwiTW4DhYHtEoU8UvrhzJJ0ZtidAdEhoLlxJkdK\ne767zzyHFx9qbd5UFgwn8XMoJKlkkJtThTARypBcbN7mq9j7bxGV0JGTm1K76KJp\nj2lIau4swGGkFWD2kTLVO5O/chj5l4gsxX2Mi9ipLiBeD2TVTwY/MV1iX5q4EVMg\n3Kt4ZSw2AxgwCPzaaSTBpkRcwJyspsAzIQfkmhnJ170v9iUsf5hg3oJV+Mhxqm/F\nznuzj1FKQ++A50O+6fGPA48T2DRATM7BMGBbjzWjRJ7KEptHEFnBGdkCU33I0YSm\nMIYXEATq5Z7D5g5SX2WZLOReTr7Y/PLCd6FRZGcFvbs5zjcKSGM=\n=Ysyl\n-----END PGP SIGNATURE-----\n. To check for available updates, use the OpenShift Console\nor the CLI oc command. Instructions for upgrading a cluster are available\nat\nhttps://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html\n\n3. Solution:\n\nFor OpenShift Container Platform 4.7 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n2066837 - CVE-2022-24769 moby: Default inheritable capabilities for linux container should be empty\n2081642 - Placeholder bug for OCP 4.7.0 extras release\n\n5. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: java-1.8.0-ibm security update\nAdvisory ID: RHSA-2023:3136-01\nProduct: Red Hat Enterprise Linux Supplementary\nAdvisory URL: https://access.redhat.com/errata/RHSA-2023:3136\nIssue date: 2023-05-16\nCVE Names: CVE-2022-21426 CVE-2023-21830 CVE-2023-21843\n====================================================================\n1. Summary:\n\nAn update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux\n7 Supplementary. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client Supplementary (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64\nRed Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64\n\n3. Description:\n\nIBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit. \n\nSecurity Fix(es):\n\n* OpenJDK: Unbounded memory allocation when compiling crafted XPath\nexpressions (JAXP, 8270504) (CVE-2022-21426)\n\n* OpenJDK: improper restrictions in CORBA deserialization (Serialization,\n8285021) (CVE-2023-21830)\n\n* OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take\neffect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n2075788 - CVE-2022-21426 OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)\n2160475 - CVE-2023-21843 OpenJDK: soundbank URL remote loading (Sound, 8293742)\n2160490 - CVE-2023-21830 OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021)\n\n6. Package List:\n\nRed Hat Enterprise Linux Client Supplementary (v. 7):\n\nx86_64:\njava-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Supplementary (v. 7):\n\nx86_64:\njava-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Server Supplementary (v. 7):\n\nppc64:\njava-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.ppc64.rpm\njava-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.ppc64.rpm\njava-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.ppc64.rpm\njava-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.ppc64.rpm\njava-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.ppc64.rpm\njava-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.ppc64.rpm\n\nppc64le:\njava-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm\njava-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm\njava-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm\njava-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm\njava-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.ppc64le.rpm\n\ns390x:\njava-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.s390x.rpm\njava-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.s390x.rpm\njava-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.s390x.rpm\njava-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.s390x.rpm\njava-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.s390x.rpm\n\nx86_64:\njava-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Supplementary (v. 7):\n\nx86_64:\njava-1.8.0-ibm-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-demo-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-devel-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-jdbc-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-plugin-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\njava-1.8.0-ibm-src-1.8.0.8.0-1jpp.1.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2023 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBZGQXddzjgjWX9erEAQjtrg//WDCW8/RkoEyTvEChqF7uHnK4V3rBSk9+\nubpNx/M2kajuILXohNxBY4tcm3jyvoL6gwwCQ3iMlWA369AHI7DturxjJQr3GziD\npbyWqMR4sIyAKJpf32a4MlUBAg01jby2PCxeiD4Llw1Gf2U/BRsDalXoVz/s7dhB\njCO3qNpIbZNmg8gG7jbWbgtCMreM17sONQdWCg5sgfRAKakgcH8xMCWpb02tmLCR\ngS7f4m24sLDhSvWQGxkhkXwhpiG5wGIYnFaS7cQzdHpHS37qOVGshTpgJEsI9c0S\nzTfYYkpCJivl/aENlnYKpVgHmSPP9Qxo0TO18A8y53bJXJBLNBjw6fjDkJLcfOuI\njwHGNnbR1vAhQieD5ACT7rTADBx8fsv2EAqgvGgopuuOPHSKQYxQgCBQu/ZqBf02\n1n3cw0OieNoqW7HqW4qrTkYxma9L5WxfAPTgZhN0OUiWMgLfNtQjuRoSHKGNtwAk\n//tqVreuJPxNGBajdvXEhDLxuBeLiUnxvkgLgaZ+J39MeI3pV5XPbR1qswy7Nsor\n4L+ulZussEs8yZfPzhBMfyARuOGBFX07Cfy1cT381KsisjoUK6OsKnByO/tsOa7d\nnrm/7B+ANBS59mTjRDKtE4/cdVIwvn9qt9/zg8kSUS1x7CjaQ2qyLbTczKyFRiSK\nQcLjOlHi3+I=ckJc\n-----END PGP SIGNATURE-----\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. Summary:\n\nSecurity updated rh-sso-7/sso75-openshift-rhel8 container image is now\navailable for RHEL-8 based Middleware Containers. Description:\n\nThe rh-sso-7/sso75-openshift-rhel8 container image has been updated for\nRHEL-8 based Middleware Containers to include the following security\nissues. \n\nUsers of rh-sso-7/sso75-openshift-rhel8 container images are advised to\nupgrade to these updated images, which contain backported patches to\ncorrect these security issues, fix these bugs and add these enhancements. \nUsers of these images are also encouraged to rebuild all container images\nthat depend on these images. \n\nYou can find images updated by this advisory in Red Hat Container Catalog\n(see References). Solution:\n\nThe RHEL-8 based Middleware Containers container image provided by this\nupdate can be downloaded from the Red Hat Container Registry at\nregistry.access.redhat.com. \n\nDockerfiles and scripts should be amended either to refer to this new image\nspecifically, or to the latest image generally. Bugs fixed (https://bugzilla.redhat.com/):\n\n2071036 - CVE-2022-1245 keycloak: Privilege escalation vulnerability on Token Exchange\n\n5",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21426"
},
{
"db": "VULHUB",
"id": "VHN-407039"
},
{
"db": "VULMON",
"id": "CVE-2022-21426"
},
{
"db": "PACKETSTORM",
"id": "167140"
},
{
"db": "PACKETSTORM",
"id": "167122"
},
{
"db": "PACKETSTORM",
"id": "167980"
},
{
"db": "PACKETSTORM",
"id": "167008"
},
{
"db": "PACKETSTORM",
"id": "169366"
},
{
"db": "PACKETSTORM",
"id": "167164"
},
{
"db": "PACKETSTORM",
"id": "172404"
},
{
"db": "PACKETSTORM",
"id": "166967"
}
],
"trust": 1.8
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2022-21426",
"trust": 2.0
},
{
"db": "PACKETSTORM",
"id": "167008",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "166967",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "167980",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "167122",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "167164",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "167140",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "167385",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "167327",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "167378",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "167388",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "167088",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "167142",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "167271",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "167979",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "166954",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-407039",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-21426",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "169366",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "172404",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-407039"
},
{
"db": "VULMON",
"id": "CVE-2022-21426"
},
{
"db": "PACKETSTORM",
"id": "167140"
},
{
"db": "PACKETSTORM",
"id": "167122"
},
{
"db": "PACKETSTORM",
"id": "167980"
},
{
"db": "PACKETSTORM",
"id": "167008"
},
{
"db": "PACKETSTORM",
"id": "169366"
},
{
"db": "PACKETSTORM",
"id": "167164"
},
{
"db": "PACKETSTORM",
"id": "172404"
},
{
"db": "PACKETSTORM",
"id": "166967"
},
{
"db": "NVD",
"id": "CVE-2022-21426"
}
]
},
"id": "VAR-202204-0593",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-407039"
}
],
"trust": 0.01
},
"last_update_date": "2026-03-09T20:58:13.931000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Red Hat: ",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2022-21426"
},
{
"title": "Arch Linux Issues: ",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2022-21426"
},
{
"title": "Red Hat: Moderate: java-1.8.0-ibm security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20233136 - Security Advisory"
},
{
"title": "Ubuntu Security Notice: USN-5388-1: OpenJDK vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-5388-1"
},
{
"title": "Ubuntu Security Notice: USN-5388-2: OpenJDK vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-5388-2"
},
{
"title": "Red Hat: Important: java-1.8.0-openjdk security, bug fix, and enhancement update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221487 - Security Advisory"
},
{
"title": "Red Hat: Important: java-11-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221442 - Security Advisory"
},
{
"title": "Red Hat: Important: java-11-openjdk security, bug fix, and enhancement update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221440 - Security Advisory"
},
{
"title": "Red Hat: Important: java-1.8.0-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221488 - Security Advisory"
},
{
"title": "Red Hat: Important: OpenJDK 8u332 Windows builds release and security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221492 - Security Advisory"
},
{
"title": "Red Hat: Important: java-11-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221441 - Security Advisory"
},
{
"title": "Red Hat: Important: OpenJDK 11.0.15 security update for Portable Linux Builds",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221435 - Security Advisory"
},
{
"title": "Red Hat: Important: java-11-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221444 - Security Advisory"
},
{
"title": "Red Hat: Important: OpenJDK 11.0.15 security update for Windows Builds",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221439 - Security Advisory"
},
{
"title": "Red Hat: Important: OpenJDK 8u332 security update for Portable Linux Builds",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221438 - Security Advisory"
},
{
"title": "Red Hat: Important: java-1.8.0-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221490 - Security Advisory"
},
{
"title": "Red Hat: Important: java-1.8.0-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221491 - Security Advisory"
},
{
"title": "Red Hat: Important: java-1.8.0-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221489 - Security Advisory"
},
{
"title": "Red Hat: Important: java-11-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221728 - Security Advisory"
},
{
"title": "Red Hat: Important: java-1.8.0-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20222137 - Security Advisory"
},
{
"title": "Red Hat: Important: java-11-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221443 - Security Advisory"
},
{
"title": "Red Hat: Important: OpenJDK 17.0.3 security update for Windows Builds",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221437 - Security Advisory"
},
{
"title": "Red Hat: Important: java-17-openjdk security and bug fix update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221445 - Security Advisory"
},
{
"title": "Red Hat: Important: OpenJDK 17.0.3 security update for Portable Linux Builds",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221436 - Security Advisory"
},
{
"title": "Red Hat: Important: java-17-openjdk security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221729 - Security Advisory"
},
{
"title": "Debian Security Advisories: DSA-5131-1 openjdk-11 -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=5c8840c405cfcf2d530316add80d95b7"
},
{
"title": "Debian Security Advisories: DSA-5128-1 openjdk-17 -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=c35e0aa61b24f917b1354b5d6ba66425"
},
{
"title": "Red Hat: Moderate: OpenShift Container Platform 4.8.41 bug fix and security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20222272 - Security Advisory"
},
{
"title": "Red Hat: Moderate: Cryostat 2.1.0: new Cryostat on RHEL 8 container images",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221679 - Security Advisory"
},
{
"title": "Red Hat: Moderate: security update for rh-sso-7/sso75-openshift-rhel8 container image",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221713 - Security Advisory"
},
{
"title": "Red Hat: Moderate: OpenShift Container Platform 4.7.50 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221699 - Security Advisory"
},
{
"title": "Ubuntu Security Notice: USN-5546-2: OpenJDK 8 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-5546-2"
},
{
"title": "Ubuntu Security Notice: USN-5546-1: OpenJDK vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-5546-1"
},
{
"title": "Red Hat: Moderate: OpenShift Container Platform 3.11.705 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20222281 - Security Advisory"
},
{
"title": "Amazon Linux 2: ALAS2-2022-1791",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2022-1791"
},
{
"title": "Amazon Linux 2: ALAS2-2022-1790",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2022-1790"
},
{
"title": "Amazon Linux 2: ALAS2-2022-1778",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2022-1778"
},
{
"title": "Amazon Linux 2: ALAS2CORRETTO8-2022-002",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2CORRETTO8-2022-002"
},
{
"title": "Red Hat: Moderate: Red Hat OpenShift Logging Security and Bug update Release 5.4.1",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20222216 - Security Advisory"
},
{
"title": "Red Hat: Moderate: Openshift Logging Security and Bug update Release (5.2.10)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20222218 - Security Advisory"
},
{
"title": "Red Hat: Moderate: Red Hat OpenShift Logging Security and Bug update Release 5.3.7",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20222217 - Security Advisory"
},
{
"title": "Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories\u0026qid=hitachi-sec-2022-113"
},
{
"title": "Hitachi Security Advisories: Multiple Vulnerabilities in Cosminexus",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories\u0026qid=hitachi-sec-2022-112"
},
{
"title": "Amazon Linux 2: ALAS2JAVA-OPENJDK11-2022-002",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2JAVA-OPENJDK11-2022-002"
},
{
"title": "Red Hat: Moderate: OpenShift Container Platform 4.6.57 security and extras update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221622 - Security Advisory"
},
{
"title": "Red Hat: Low: Release of OpenShift Serverless Version 1.22.0",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221747 - Security Advisory"
},
{
"title": "Amazon Linux AMI: ALAS-2022-1633",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2022-1633"
},
{
"title": "Amazon Linux AMI: ALAS-2022-1631",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2022-1631"
},
{
"title": "Amazon Linux 2: ALAS2-2022-1835",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2022-1835"
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-23305 "
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-RCE "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-21426"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21426"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 1.2,
"url": "https://security.netapp.com/advisory/ntap-20220429-0006/"
},
{
"trust": 1.2,
"url": "https://www.debian.org/security/2022/dsa-5128"
},
{
"trust": 1.2,
"url": "https://www.debian.org/security/2022/dsa-5131"
},
{
"trust": 1.2,
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"trust": 1.2,
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21426"
},
{
"trust": 0.7,
"url": "https://access.redhat.com/security/cve/cve-2022-21426"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21443"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21496"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21434"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21476"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.6,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.6,
"url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2022-21476"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2022-21496"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2022-21443"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2022-21434"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2018-25032"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-25032"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-1154"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2022-1154"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-25636"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2022-25636"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-0778"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2022-0778"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2022-1271"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-1271"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21449"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/errata/rhsa-2023:3136"
},
{
"trust": 0.2,
"url": "https://issues.jboss.org/):"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43797"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2022-0759"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-37137"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-43797"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2022-21698"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-37137"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-4028"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-37136"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-4028"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-37136"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-0759"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21698"
},
{
"trust": 0.2,
"url": "https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2022-1245"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5388-1"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:2218"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:2217"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~22.04"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~20.04"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~18.04"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5546-1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21540"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~22.04"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~20.04"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-18/18.0.2+9-2~22.04"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21541"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~22.04"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-34169"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-17/17.0.4+8-1~20.04"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-8/8u342-b07-0ubuntu1~18.04"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.16+8-0ubuntu1~18.04"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21549"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-31566"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-22825"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23308"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-25236"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-23177"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23219"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23218"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:1747"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-23177"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-22825"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-23308"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-22827"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-21449"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-22823"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-25235"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3999"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-46143"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-22826"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-23218"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-41772"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-25235"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23852"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-46143"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-22827"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3999"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-22824"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-22823"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-22824"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-45960"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-41772"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-22826"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-41771"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-22822"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-41771"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-23852"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-23219"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-25315"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-31566"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-22822"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-45960"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/openjdk-11"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-0492"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-4083"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhba-2022:1698"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-4083"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-24769"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-0492"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:1699"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24769"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-21843"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2023-21830"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2023-21843"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-21830"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/containers/?tab=images#/registry.access.redhat.com/rh-sso-7/sso75-openshift-rhel8"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-1245"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html/release_notes/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:1713"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-407039"
},
{
"db": "VULMON",
"id": "CVE-2022-21426"
},
{
"db": "PACKETSTORM",
"id": "167140"
},
{
"db": "PACKETSTORM",
"id": "167122"
},
{
"db": "PACKETSTORM",
"id": "167980"
},
{
"db": "PACKETSTORM",
"id": "167008"
},
{
"db": "PACKETSTORM",
"id": "169366"
},
{
"db": "PACKETSTORM",
"id": "167164"
},
{
"db": "PACKETSTORM",
"id": "172404"
},
{
"db": "PACKETSTORM",
"id": "166967"
},
{
"db": "NVD",
"id": "CVE-2022-21426"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "VULHUB",
"id": "VHN-407039",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2022-21426",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "167140",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "167122",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "167980",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "167008",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "169366",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "167164",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "172404",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "166967",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2022-21426",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2022-04-19T00:00:00",
"db": "VULHUB",
"id": "VHN-407039",
"ident": null
},
{
"date": "2022-04-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21426",
"ident": null
},
{
"date": "2022-05-12T15:53:27",
"db": "PACKETSTORM",
"id": "167140",
"ident": null
},
{
"date": "2022-05-12T15:38:35",
"db": "PACKETSTORM",
"id": "167122",
"ident": null
},
{
"date": "2022-08-05T14:51:20",
"db": "PACKETSTORM",
"id": "167980",
"ident": null
},
{
"date": "2022-05-10T14:49:09",
"db": "PACKETSTORM",
"id": "167008",
"ident": null
},
{
"date": "2022-05-28T19:12:00",
"db": "PACKETSTORM",
"id": "169366",
"ident": null
},
{
"date": "2022-05-13T16:05:21",
"db": "PACKETSTORM",
"id": "167164",
"ident": null
},
{
"date": "2023-05-17T14:05:00",
"db": "PACKETSTORM",
"id": "172404",
"ident": null
},
{
"date": "2022-05-05T17:31:42",
"db": "PACKETSTORM",
"id": "166967",
"ident": null
},
{
"date": "2022-04-19T21:15:15.157000",
"db": "NVD",
"id": "CVE-2022-21426",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2022-07-28T00:00:00",
"db": "VULHUB",
"id": "VHN-407039",
"ident": null
},
{
"date": "2023-04-27T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21426",
"ident": null
},
{
"date": "2024-11-21T06:44:40.450000",
"db": "NVD",
"id": "CVE-2022-21426",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "167980"
}
],
"trust": 0.1
},
"title": {
"_id": null,
"data": "Red Hat Security Advisory 2022-2218-01",
"sources": [
{
"db": "PACKETSTORM",
"id": "167140"
}
],
"trust": 0.1
},
"type": {
"_id": null,
"data": "info disclosure",
"sources": [
{
"db": "PACKETSTORM",
"id": "169366"
}
],
"trust": 0.1
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.