Title: EGI SVG 'ADVISORY' [TLP:WHITE] Up to 'CRITICAL' risk vulnerability
in Java 15 and later [EGI-SVG-CVE-2022-21449]
Date: 2022-04-26
Updated:
Affected software and risk
==========================
Up to 'CRITICAL' risk vulnerability concerning Java 15 and later
Package : Java
CVE ID : CVE-2022-21449
Bug ID :
CVSS Score : 7.5 [R 1]
A vulnerability has been found in Java, involving Improper Verification of
Cryptographic Signature. Successful attacks of this vulnerability can result
in unauthorized creation, deletion or modification access to critical data
[R 2]. This affects one of the default versions of the OpenJDK shipped
with RHEL 8 and its derivatives. None of the official RHEL7 (and derivatives)
OpenJDK versions are affected.
Exposure within the EGI infrastructure seems limited, but sites are urged to
check locally for services running Java 15 and up.
Actions required/recommended
============================
Those running any of the versions of the OpenJDK included in RHEL 7 and its
derivatives are unlikely to be affected and do not need to take action.
Services which use Java and run RHEL 8 and its derivatives, or install Java
from other sources should check that they are not running a vulnerable version
and take action to update if they are.
If anyone becomes aware of any situation where this vulnerability is exposed
on the EGI infrastructure then please inform EGI SVG.
Component installation information
==================================
Sites running RHEL should see [R 2]
Sites running CentOS should also see [R 2]
Sites running Debian should see [R 3]
Sites running Ubuntu should see [R 4]
Sites running RockyLinux should see [R 5]
Sites running Almalinux should see [R 6]
Mitigation
==========
None has been recommended.
More information
================
This advisory may be updated if we find a situation or configuration where
a number of sites are likely to be affected.
TLP and URL
===========
** WHITE information - Unlimited distribution
- see https://go.egi.eu/tlp for
distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2022-21449
Minor updates may be made without re-distribution to the sites
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 99]
References
==========
[R 1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21449
[R 2] https://access.redhat.com/security/cve/CVE-2022-21449
[R 3] https://security-tracker.debian.org/tracker/CVE-2022-21449
[R 4] http://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-21449.html
[R 5] RockyLinux https://errata.rockylinux.org/
[R 6] AlmaLinux https://errata.almalinux.org/
[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867
Credit
======
SVG was alerted to this vulnerability by Mischa Salle
Timeline
========
Yyyy-mm-dd [EGI-SVG-CVE-2022-21449]
2022-04-20 SVG alerted to this issue by Mischa Salle
2022-04-21 Acknowledgement from the EGI SVG to the reporter
2022-04-22 Investigation of vulnerability and relevance to EGI carried out
2022-04-25 Became aware of one instance where this vulnerability is relevant in EGI
2022-04-25 EGI SVG Risk Assessment completed - on the assumption that this software is in use
2022-04-25 Decided to issue an advisory, in case of further relevance in EGI
2022-04-26 Advisory sent to sites
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 99] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.
-----------------------------
This advisory is subject to the Creative commons licence
https://creativecommons.org/licenses/by/4.0/
and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited.
-----------------------------
On behalf of the EGI SVG,