21.08.300.0
21.08.300.0
Release date: January 18, 2022
This CPU release is based on the following OpenJDK versions:
| Major Version | OpenJDK Version |
|---|---|
7 |
7u331 |
8 |
8u321 |
11 |
11.0.13.0.101+2 |
13 |
13.0.9.0.101+1 |
15 |
15.0.5.0.101+2 |
CVE fixes
| CVE # | Component | Protocol | Remote Exploit w/o Auth. | Base Score | Attack Vector | Attack Complex | Privileges Req’d | User Interact | Scope | Confiden-tiality | Integrity | Availability | Versions Affected | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
ImageIO |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11 |
Note 1 |
|
JAXP |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
Low |
None |
None |
17, 15, 13, 11, 8, 7 |
Note 1 |
|
Libraries |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
Hotspot |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
Low |
None |
17, 15, 13, 11 |
Note 1 |
|
Libraries |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
Libraries |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
JAXP |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
Low |
None |
None |
17, 15, 13, 11, 8, 7 |
Note 1 |
|
JAXP |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
Hotspot |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
Low |
None |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
Libraries |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
Serialization |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
2D |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
8, 7 |
Note 1 |
|
ImageIO |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
ImageIO |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
ImageIO |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
17, 15, 13, 11 |
Note 1 |
|
Serialization |
Multiple |
Yes |
3.7 |
Network |
High |
None |
None |
Unchanged |
None |
Low |
None |
17, 15, 13, 11, 8, 7, 6 |
Note 1 |
|
CVE-2021-22959 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
Oracle GraalVM Enterprise Edition: Node (Node.js) |
HTTP |
Yes |
6.5 |
Network |
Low |
None |
None |
Unchanged |
Low |
Low |
None |
None |
|
CVE-2022-21271 This CVE is not applicable to Azul Zing Builds of OpenJDK. It is listed here for comparison with other Java implementations which may contain this CVE. |
Oracle GraalVM Enterprise Edition: Libraries |
Multiple |
Yes |
5.3 |
Network |
Low |
None |
None |
Unchanged |
None |
None |
Low |
None |
Note 1 |
Notes:
| ID | Notes |
|---|---|
1 |
This vulnerability applies to Java deployments, typically in clients running sandboxed Java applications, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. |