What is CVE-2023-22081?

CVE-2023-22081 is a medium-severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, specifically affecting the JSSE component. This vulnerability allows unauthenticated attackers with network access via HTTPS to cause a partial denial of service (partial DOS) on systems running Java deployments, such as sandboxed Java Web Start applications or sandboxed Java applets.

Who is impacted by CVE-2023-22081?

The CVE-2023-22081 vulnerability affects users of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, and OpenJDK Java runtime. Affected versions include Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7, 22.3.3; OpenJDK Java runtime: versions prior to 11.0.21+9-1~deb10u1, oldstable distribution (bullseye) before 11.0.21+9-1~deb11u1, and versions 17.0.9+9-1~deb11u1 and 17.0.9+9-1~deb12u1. This vulnerability allows unauthenticated attackers with network access via HTTPS to cause a partial denial of service on affected systems.

What to do if CVE-2023-22081 affected you

If you're affected by the CVE-2023-22081 vulnerability, it's crucial to take immediate action to protect your systems. Start by upgrading the affected software packages to the fixed versions, such as openjdk-11, openjdk-17, or Oracle Java SE. Regularly update your software and follow security best practices, like limiting user access, using strong passwords, and monitoring system logs for suspicious activity.

• Upgrade affected software packages to fixed versions

• Regularly update software and apply security patches

• Limit user access and permissions

• Use strong and unique passwords

• Monitor system logs for suspicious activity

• Implement network security measures

• Educate users about security best practices

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-22081 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, found in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, affects the JSSE component and allows unauthenticated attackers with network access via HTTPS to cause a partial denial of service. To protect your systems, it's crucial to upgrade affected software packages to fixed versions and follow security best practices.

Weakness Enumeration

The weakness enumeration for this vulnerability is "Insufficient Information," indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources listed below:

• Debian LTS Announcement - openjdk-11 security update

• NetApp Product Security - Java Platform Standard Edition Vulnerabilities

• Debian Security Advisory - openjdk-11 security update

• Debian Security Advisory - openjdk-17 security update