CVE-2022-21449
HighOpenJDK: Improper ECDSA signature verification (Libraries, 8277233)
Published Jun 20, 2022 · Updated Sep 8, 2026 · Also known as BIT-java-2022-21449, BIT-java-min-2022-21449, BIT-jre-2022-21449, DEBIAN-CVE-2022-21449, UBUNTU-CVE-2022-21449
Key Facts
Patch immediately- CVE-2022-21449 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Zulu (Azul), 7-Mode Transition Tool (Netapp), Active Iq Unified Manager (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 77% probability of exploitation in the next 30 days.
- Fixed versions are available, including java 17-openjdk-1:17.0.3.0.6-2.el8_5, java 17-openjdk-1:17.0.3.0.7-1.el9_0, java 17.0.3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (30-day exploit likelihood)
77%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-21449 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Affected Products
330 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ZuluAzul | 15.38, 17.32, 18.28 | n/a |
| 7-Mode Transition ToolNetapp | See advisory | n/a |
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| Cloud InsightsNetapp | See advisory | n/a |
| E-Series Santricity OS ControllerNetapp | 11.0 | n/a |
Patched Releases
java
17-openjdk-1:17.0.3.0.6-2.el8_5, 17-openjdk-1:17.0.3.0.7-1.el9_0, 17.0.3, 18.0.1
java-1_7_1-ibm
1.7.1_sr5.10-38.71.1
java-1_7_1-ibm-alsa
1.7.1_sr5.10-38.71.1
java-1_7_1-ibm-devel
1.7.1_sr5.10-38.71.1
java-1_7_1-ibm-jdbc
1.7.1_sr5.10-38.71.1
java-1_7_1-ibm-plugin
1.7.1_sr5.10-38.71.1
java-1_8_0-ibm
1.8.0_sr7.10-150000.3.59.1, 1.8.0_sr7.10-30.90.1
java-1_8_0-ibm-32bit
1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-alsa
1.8.0_sr7.10-150000.3.59.1, 1.8.0_sr7.10-30.90.1
java-1_8_0-ibm-demo
1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-devel
1.8.0_sr7.10-150000.3.59.1, 1.8.0_sr7.10-30.90.1
java-1_8_0-ibm-devel-32bit
1.8.0_sr7.10-150000.3.59.1
java-1_8_0-ibm-plugin
1.8.0_sr7.10-150000.3.59.1, 1.8.0_sr7.10-30.90.1
java-1_8_0-ibm-src
1.8.0_sr7.10-150000.3.59.1
java-15-openjdk
15.0.7.0-1.1
java-15-openjdk-accessibility
15.0.7.0-1.1
java-15-openjdk-demo
15.0.7.0-1.1
java-15-openjdk-devel
15.0.7.0-1.1
java-15-openjdk-headless
15.0.7.0-1.1
java-15-openjdk-javadoc
15.0.7.0-1.1
java-15-openjdk-jmods
15.0.7.0-1.1
java-15-openjdk-src
15.0.7.0-1.1
java-17-amazon-corretto
1:17.0.3+6-1.amzn2.1
java-17-amazon-corretto-devel
1:17.0.3+6-1.amzn2.1
java-17-amazon-corretto-headless
1:17.0.3+6-1.amzn2.1
Timeline
Publicly disclosed
Jun 20, 2022
Last updated
Sep 8, 2026
Weakness Type
- CWE-347 Improper Verification of Cryptographic Signature
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35550
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23773
- advisoryRHSA-2022:1436
- advisoryRHSA-2022:1437
- advisoryRHSA-2022:1445
FAQ
Common Questions.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
Affected: Zulu (Azul) versions 15.38, 17.32, 18.28; 7-Mode Transition Tool (Netapp); Active Iq Unified Manager (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including java 17-openjdk-1:17.0.3.0.6-2.el8_5, java 17-openjdk-1:17.0.3.0.7-1.el9_0, java 17.0.3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-21449 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo