Hide Forgot
It was discovered that the ObjectInputStream class implementation in the Serialization component of OpenJDK did not sufficiently validate data read from the input serialized stream when reading serialized exceptions. A specially-crafted serialized stream could use this flaw to bypass certain deserialization restrictions (defined via jdk.serialFilter system or security property).
Public now via Oracle CPU January 2022: https://www.oracle.com/security-alerts/cpujan2022.html#AppendixJAVA Fixed in Oracle Java SE 17.0.2, 11.0.14, 8u321, and 7u331.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:0161 https://access.redhat.com/errata/RHSA-2022:0161
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:0233 https://access.redhat.com/errata/RHSA-2022:0233
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:0209 https://access.redhat.com/errata/RHSA-2022:0209
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:0185 https://access.redhat.com/errata/RHSA-2022:0185
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:0211 https://access.redhat.com/errata/RHSA-2022:0211
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:0204 https://access.redhat.com/errata/RHSA-2022:0204
This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.2 Via RHSA-2022:0166 https://access.redhat.com/errata/RHSA-2022:0166
This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.2 Via RHSA-2022:0165 https://access.redhat.com/errata/RHSA-2022:0165
This issue has been addressed in the following products: Red Hat Build of OpenJDK 11.0.14 Via RHSA-2022:0228 https://access.redhat.com/errata/RHSA-2022:0228
This issue has been addressed in the following products: Red Hat Build of OpenJDK 11.0.14 Via RHSA-2022:0229 https://access.redhat.com/errata/RHSA-2022:0229
OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/6f3ace565330e3d0029600a50e206f08c462b552 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u-dev/commit/1e561513456470332642efc3ee99c749ff5f8d40 OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/monojdk8u/rev/0dc979a234d0
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:0304 https://access.redhat.com/errata/RHSA-2022:0304
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:0305 https://access.redhat.com/errata/RHSA-2022:0305
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:0307 https://access.redhat.com/errata/RHSA-2022:0307
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:0306 https://access.redhat.com/errata/RHSA-2022:0306
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:0312 https://access.redhat.com/errata/RHSA-2022:0312
This issue has been addressed in the following products: Red Hat Build of OpenJDK 8u322 Via RHSA-2022:0321 https://access.redhat.com/errata/RHSA-2022:0321
This issue has been addressed in the following products: Red Hat Build of OpenJDK 8u322 Via RHSA-2022:0317 https://access.redhat.com/errata/RHSA-2022:0317
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-21341
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:0970 https://access.redhat.com/errata/RHSA-2022:0970
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2022:0969 https://access.redhat.com/errata/RHSA-2022:0969
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2022:0968 https://access.redhat.com/errata/RHSA-2022:0968