Linux · Oracle Linux · Security advisory · October 25, 2022

ELSA-2022-9952: Security update for 19 packages

ELSA-2022-9952, released October 25, 2022, fixes 14 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
14
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.8183
99th percentile

Priority of the 14 CVEs

Patch now 0 Urgent 0 High 6 Routine 8

Fixed package versions

ProductReleaseFixed in
graalvm22-ce-11ol 90:22.3.0-1.el9
graalvm22-ce-11-develol 90:22.3.0-1.el9
graalvm22-ce-11-espressool 90:22.3.0-1.el9
graalvm22-ce-11-javascriptol 90:22.3.0-1.el9
graalvm22-ce-11-jdkol 90:22.3.0-1.el9
graalvm22-ce-11-libpolyglotol 90:22.3.0-1.el9
graalvm22-ce-11-llvmol 90:22.3.0-1.el9
graalvm22-ce-11-llvm-toolchainol 90:22.3.0-1.el9
graalvm22-ce-11-native-imageol 90:22.3.0-1.el9
graalvm22-ce-11-native-image-llvm-backendol 90:22.3.0-1.el9
graalvm22-ce-11-nodejsol 90:22.3.0-1.el9
graalvm22-ce-11-nodejs-develol 90:22.3.0-1.el9
graalvm22-ce-11-polyglotol 90:22.3.0-1.el9
graalvm22-ce-11-pythonol 90:22.3.0-1.el9
graalvm22-ce-11-python-develol 90:22.3.0-1.el9
graalvm22-ce-11-rubyol 90:22.3.0-1.el9
graalvm22-ce-11-ruby-develol 90:22.3.0-1.el9
graalvm22-ce-11-toolsol 90:22.3.0-1.el9
graalvm22-ce-11-wasmol 90:22.3.0-1.el9

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2022-32214 Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)9.1 0.8183 None reported
High CVE-2022-32215 Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)9.1 0.7024 None reported
High CVE-2022-32213 Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)9.1 0.4484 None reported
High CVE-2022-32212 Node.js 14 and 2 others: Improper Access Control - Generic (CWE-284)8.1 0.0643 None reported
High CVE-2022-35256 Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)9.8 0.0276 None reported
High CVE-2022-35255 Node.js 16 and 2 others: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)9.1 0.0209 None reported
Routine CVE-2022-2097 libssl3t64: AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimisedimplementation will not encrypt the entirety...6.7 0.0490 None reported
Routine CVE-2022-21619 java-11-openjdk-jmods-slowdebug: The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Develop...5.3 0.0333 None reported
Routine CVE-2022-21628 java-1.8.0-openjdk-javadoc: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Develo...5.3 0.0288 None reported
Routine CVE-2022-21618 java-11-openjdk-demo-fastdebug: The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Develop...5.3 0.0281 None reported
Routine CVE-2022-21626 java-1.8.0-openjdk: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Develo...5.3 0.0243 None reported
Routine CVE-2022-32222 Node.js 18: Cryptographic Issues - Generic (CWE-310)5.3 0.0219 None reported
Routine CVE-2022-39399 java-17-openjdk-devel-slowdebug: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...5.3 0.0204 None reported
Routine CVE-2022-21624 java-17-openjdk-javadoc: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...5.3 0.0197 None reported
Showing 1 to 14 of 14 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.