Linux · Security advisory · January 24, 2023
ELSA-2023-12072: Security update for 21 packages
ELSA-2023-12072, released January 24, 2023, fixes 4 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.1484
96th percentile
Priority of the 4 CVEs
Patch now 0
Urgent 0
High 1
Routine 3
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| graalvm22-ce-17 | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-espresso | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-espresso-llvm | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-fastr | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-javascript | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-jdk | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-libpolyglot | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-llvm | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-llvm-toolchain | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-native-image | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-native-image-llvm-backend | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-nodejs | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-nodejs-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-polyglot | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-python | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-python-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-ruby | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-ruby-devel | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-tools | ol 8 | 0:22.3.1-1.el8 |
| graalvm22-ce-17-wasm | ol 8 | 0:22.3.1-1.el8 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2022-43548 | Node.js 14 and 2 others: OS Command Injection (CWE-78) | 9.8 | 0.1484 | None reported | |
| Routine | CVE-2023-21835 | openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Editionproduct of Oracle Java SE (component: JSSE) | 5.3 | 0.0190 | None reported | |
| Routine | CVE-2023-21843 | openjdk-17-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Editionproduct of Oracle Java SE (component: Sound) | 5.3 | 0.0141 | None reported | |
| Routine | CVE-2023-21830 | java-1.8.0-openjdk-accessibility: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Develo... | 5.3 | 0.0109 | None reported |
Showing 1 to 4 of 4
1