EGI SVG Advisories


Title:   EGI SVG 'ADVISORY' [TLP:WHITE] Up to 'CRITICAL' risk vulnerability 
         in Java 15 and later [EGI-SVG-CVE-2022-21449] 
Date:        2022-04-26

Affected software and risk

Up to 'CRITICAL' risk vulnerability concerning Java 15 and later

Package    : Java
CVE ID     : CVE-2022-21449
Bug ID     : 
CVSS Score : 7.5 [R 1] 

A vulnerability has been found in Java, involving Improper Verification of 
Cryptographic Signature. Successful attacks of this vulnerability can result 
in unauthorized creation, deletion or modification access to critical data 
[R 2].  This affects one of the default versions of the OpenJDK shipped 
with RHEL 8 and its derivatives. None of the official RHEL7 (and derivatives) 
OpenJDK versions are affected.

Exposure within the EGI infrastructure seems limited, but sites are urged to 
check locally for services running Java 15 and up.

Actions required/recommended

Those running any of the versions of the OpenJDK included in RHEL 7 and its 
derivatives are unlikely to be affected and do not need to take action.

Services which use Java and run RHEL 8 and its derivatives, or install Java 
from other sources should check that they are not running a vulnerable version 
and take action to update if they are.  

If anyone becomes aware of any situation where this vulnerability is exposed 
on the EGI infrastructure then please inform EGI SVG.

Component installation information

Sites running RHEL should see [R 2]

Sites running CentOS should also see [R 2]

Sites running Debian should see [R 3]

Sites running Ubuntu should see [R 4]

Sites running RockyLinux should see [R 5] 

Sites running Almalinux should see [R 6]


None has been recommended.

More information

This advisory may be updated if we find a situation or configuration where 
a number of sites are likely to be affected.

** WHITE information - Unlimited distribution
 - see for
   distribution restrictions **
Minor updates may be made without re-distribution to the sites

Comments or questions should be sent to svg-rat  at
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to

report-vulnerability at

the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 99]


[R 1]

[R 2] 

[R 3]

[R 4] 

[R 5]  RockyLinux 

[R 6]  AlmaLinux 

[R 99]


SVG was alerted to this vulnerability by Mischa Salle 

Yyyy-mm-dd  [EGI-SVG-CVE-2022-21449] 

2022-04-20 SVG alerted to this issue by Mischa Salle
2022-04-21 Acknowledgement from the EGI SVG to the reporter
2022-04-22 Investigation of vulnerability and relevance to EGI carried out
2022-04-25 Became aware of one instance where this vulnerability is relevant in EGI  
2022-04-25 EGI SVG Risk Assessment completed - on the assumption that this software is in use
2022-04-25 Decided to issue an advisory, in case of further relevance in EGI  
2022-04-26 Advisory sent to sites

This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 99] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.
This advisory is subject to the Creative commons licence 
and the EGI Software Vulnerability Group must be credited. 
On behalf of the EGI SVG,