CVE-2022-21549: 
NixOS vulnerability analysis and mitigation

CVE-2022-21549 is a vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition's Libraries component. The affected versions include Oracle Java SE 17.0.3.1 and Oracle GraalVM Enterprise Edition versions 21.3.2 and 22.1.0. This vulnerability was disclosed in July 2022 and specifically affects Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets (Oracle CPU).

The vulnerability is characterized as easily exploitable and allows unauthenticated attackers with network access via multiple protocols to compromise Oracle Java SE and Oracle GraalVM Enterprise Edition. The vulnerability specifically affects java.util.random's handling of exponential and Gaussian distributions. It has been assigned a CVSS 3.1 Base Score of 5.3 (Integrity impacts) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE and Oracle GraalVM Enterprise Edition accessible data. The vulnerability is particularly concerning for Java deployments that rely on the Java sandbox for security and load untrusted code from the internet (Oracle CPU).

Oracle released patches for this vulnerability in the July 2022 Critical Patch Update. Users should upgrade to the fixed versions: Oracle Java SE version beyond 17.0.4.0.8, Oracle GraalVM Enterprise Edition versions beyond 21.3.2 and 22.1.0. Various Linux distributions have also released patches, including Fedora 35 and 36, and Debian 11 (Fedora Update, Debian Security).