Security readout for executives and security teams
Plain-English summary
This is a denial-of-service issue in Oracle Java SE and GraalVM Enterprise Edition serialization handling. An unauthenticated network attacker could cause partial service disruption in affected deployments. It is not described as data theft or code execution in the provided sources.
Executive priority
Treat this as a moderate availability risk. Prioritize patching internet-facing or business-critical Java services first, especially where untrusted input reaches serialization APIs. It is lower urgency than code execution or data exposure flaws, based on the provided evidence.
Technical view
CVE-2022-21341 is a CWE-502 serialization vulnerability affecting listed Oracle Java SE and GraalVM Enterprise Edition versions. Oracle rates it CVSS 5.3, network-accessible, low complexity, no privileges, no user interaction, with low availability impact only.
Likely exposure
Exposure is most likely in affected Java runtimes that run untrusted sandboxed Java code or services that pass externally supplied data into serialization-related APIs. Inventory should focus on the listed Oracle Java SE, GraalVM Enterprise Edition, and downstream OpenJDK packages.
Exploitation context
The Oracle description says the issue is easily exploitable over multiple protocols. The provided bundle does not show CISA KEV listing, active exploitation, public exploit evidence, or exploitation in the wild.
Researcher notes
The key scoping nuance is Oracle's note: Java sandboxed-client deployments and API use of the Serialization component are relevant. Do not assume every Java application is exploitable without confirming affected versions and data paths into the component.
Mitigation direction
- Apply Oracle January 2022 CPU updates or current vendor-supported Java builds.
- Update affected Debian OpenJDK packages using DSA-5057, DSA-5058, or DLA-2917-1 guidance.
- Apply Gentoo GLSA-202209-05 guidance where Gentoo packages are used.
- Reduce exposure of services that feed untrusted data into Java serialization APIs.
- Retire or tightly control sandboxed Java Web Start or applet-style untrusted code deployments.
Validation and detection
- Inventory runtime versions for Oracle Java SE 7u321, 8u311, 11.0.13, and 17.0.1.
- Inventory GraalVM Enterprise Edition 20.3.4 and 21.3.0 deployments.
- Check Debian, Gentoo, and other package manager records for the referenced security updates.
- Review application paths where remote inputs reach Java serialization APIs.
- Confirm affected Java-facing services are patched or isolated from untrusted network input.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-21341 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4oracleVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpujan2022.htmlCVE reference, oracle · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220121-0007/CVE reference, oracle · x_refsource_CONFIRM
- DSA-5057CVE reference, oracle · vendor-advisory, x_refsource_DEBIAN
- DSA-5058CVE reference, oracle · vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security updateCVE reference, oracle · mailing-list, x_refsource_MLIST
- GLSA-202209-05CVE reference, oracle · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.