# ELSA-2022-9652: Security update for 19 packages

ELSA-2022-9652, released July 26, 2022, fixes 5 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/elsa-2022-9652
- Platform: Linux
- Released: Jul 26, 2022
- Priority: High (Closes CVE-2022-34169, high severity)
- CVEs: 5, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://linux.oracle.com/errata/ELSA-2022-9652.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [graalvm21-ce-17](https://patchblox.com/security/data/product/linux/graalvm21-ce-17.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-devel](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-devel.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-espresso](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-espresso.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-fastr](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-fastr.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-javascript](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-javascript.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-jdk](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-jdk.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-libpolyglot](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-libpolyglot.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-llvm](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-llvm.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-llvm-toolchain](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-llvm-toolchain.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-native-image](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-native-image.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-nodejs](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-nodejs.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-nodejs-devel](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-nodejs-devel.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-polyglot](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-polyglot.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-python](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-python.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-python-devel](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-python-devel.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-ruby](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-ruby.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-ruby-devel](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-ruby-devel.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-tools](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-tools.md) | ol 8 | 0:21.3.3-1.el8 |
| [graalvm21-ce-17-wasm](https://patchblox.com/security/data/product/linux/graalvm21-ce-17-wasm.md) | ol 8 | 0:21.3.3-1.el8 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2022-34169](https://patchblox.com/security/data/cve/CVE-2022-34169.md) | High | Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets | 9.8 | 0.8176 |  |
| [CVE-2022-25647](https://patchblox.com/security/data/cve/CVE-2022-25647.md) | High | libgoogle-gson-java: The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeR... | 7.5 | 0.1223 |  |
| [CVE-2022-21540](https://patchblox.com/security/data/cve/CVE-2022-21540.md) | High | Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Use After Free | 7.5 | 0.0417 |  |
| [CVE-2022-21541](https://patchblox.com/security/data/cve/CVE-2022-21541.md) | High | Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… | 7.5 | 0.0291 |  |
| [CVE-2022-21549](https://patchblox.com/security/data/cve/CVE-2022-21549.md) | High | openjdk-17-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries) | 7.5 | 0.0252 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo