Linux · Security advisory · January 24, 2023
ELSA-2023-12070: Security update for 21 packages
ELSA-2023-12070, released January 24, 2023, fixes 4 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.1484
96th percentile
Priority of the 4 CVEs
Patch now 0
Urgent 0
High 1
Routine 3
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| graalvm22-ce-11 | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-espresso | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-espresso-llvm | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-fastr | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-javascript | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-jdk | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-libpolyglot | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-llvm | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-llvm-toolchain | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-native-image | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-native-image-llvm-backend | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-nodejs | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-nodejs-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-polyglot | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-python | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-python-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-ruby | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-ruby-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-tools | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-11-wasm | ol 8 | 0:22.3.1-1.el8 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2022-43548 | Node.js 14 and 2 others: OS Command Injection (CWE-78) | 9.8 | 0.1484 | None reported | |
| Routine | CVE-2023-21835 | openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Editionproduct of Oracle Java SE (component: JSSE) | 5.3 | 0.0190 | None reported | |
| Routine | CVE-2023-21843 | openjdk-17-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Editionproduct of Oracle Java SE (component: Sound) | 5.3 | 0.0141 | None reported | |
| Routine | CVE-2023-21830 | java-1.8.0-openjdk-accessibility: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Develo... | 5.3 | 0.0109 | None reported |
Showing 1 to 4 of 4
1