CVE-2023-22081:Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition's JSSE component allowing unauthenticated attackers to cause partial denial of service via HTTPS.

splash
Back

Description Preview

A vulnerability has been identified in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition's JSSE (Java Secure Socket Extension) component. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTPS to compromise affected systems, potentially resulting in a partial denial of service. The vulnerability primarily affects Java deployments that load and run untrusted code from the internet, such as sandboxed Java Web Start applications or Java applets, and rely on the Java sandbox for security. Server deployments that only run trusted code installed by administrators are not affected by this vulnerability.

Overview

CVE-2023-22081 affects multiple Oracle Java products including Oracle Java SE (versions 8u381, 8u381-perf, 11.0.20, 17.0.8, 21), Oracle GraalVM for JDK (versions 17.0.8, 21), and Oracle GraalVM Enterprise Edition (versions 20.3.11, 21.3.7, 22.3.3). The vulnerability exists in the JSSE component, which is responsible for secure socket communications. An unauthenticated attacker with network access via HTTPS can exploit this vulnerability to cause a partial denial of service, impacting the availability of the affected systems. The vulnerability has been assigned a CVSS 3.1 Base Score of 5.3 (Medium severity), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and low impact on availability.

Remediation

To address this vulnerability, users should apply the appropriate patches or updates as follows:

  1. Update Oracle Java SE to the latest version that includes fixes for this vulnerability.
  2. Update Oracle GraalVM for JDK to the latest patched version.
  3. Update Oracle GraalVM Enterprise Edition to the latest patched version.
  4. For Debian users, follow the instructions in the Debian Security Advisory DSA-5537 and DSA-5548.
  5. For NetApp products, follow the guidance provided in the NetApp Security Advisory NTAP-20231027-0006.
  6. Implement network security controls to restrict unauthorized HTTPS access to systems running vulnerable versions.
  7. Consider disabling Java Web Start applications and Java applets if not required.

References

  1. Oracle Critical Patch Update Advisory - October 2023: https://www.oracle.com/security-alerts/cpuoct2023.html
  2. Debian Security Advisory DSA-5537: https://www.debian.org/security/2023/dsa-5537
  3. Debian Security Advisory DSA-5548: https://www.debian.org/security/2023/dsa-5548
  4. Debian LTS Announcement: https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html
  5. NetApp Security Advisory NTAP-20231027-0006: https://security.netapp.com/advisory/ntap-20231027-0006/

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Health Care & Social Assistance
    Health Care & Social Assistance
  3. Public Administration
    Public Administration
  4. Finance and Insurance
    Finance and Insurance
  5. Transportation & Warehousing
    Transportation & Warehousing
  6. Educational Services
    Educational Services
  7. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  8. Other Services (except Public Administration)
    Other Services (except Public Administration)
  9. Retail Trade
    Retail Trade
  10. Utilities
    Utilities
  11. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  12. Management of Companies & Enterprises
    Management of Companies & Enterprises
  13. Information
    Information
  14. Accommodation & Food Services
    Accommodation & Food Services
  15. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  16. Mining
    Mining
  17. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  18. Construction
    Construction
  19. Wholesale Trade
    Wholesale Trade
  20. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background