{"schema_version":"1.9.0","id":"CVE-2023-21938","published":"2023-04-18T19:54:25.948Z","modified":"2026-08-12T03:51:19.526938128Z","aliases":["BIT-java-2023-21938","BIT-java-min-2023-21938","BIT-jre-2023-21938"],"related":["ALSA-2023:1879","ALSA-2023:1880","ALSA-2023:1895","ALSA-2023:1898","ALSA-2023:1908","ALSA-2023:1909","CGA-x8x6-f2xg-xj2f","SUSE-SU-2023:2109-1","SUSE-SU-2023:2110-1","SUSE-SU-2023:2222-1","SUSE-SU-2023:2238-1","SUSE-SU-2023:2242-1","SUSE-SU-2023:2242-2","SUSE-SU-2023:2476-1","SUSE-SU-2023:2491-1","SUSE-SU-2023:3305-1","openSUSE-SU-2024:12891-1","openSUSE-SU-2024:12892-1","openSUSE-SU-2024:12909-1","openSUSE-SU-2024:13110-1","openSUSE-SU-2024:13130-1","openSUSE-SU-2024:13131-1","openSUSE-SU-2025:0066-1","openSUSE-SU-2025:0067-1"],"details":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graalvm/graalvm-ce-builds","events":[{"introduced":"78e9d6d2d69753957b76d4dca05cac497221ff85"},{"last_affected":"78e9d6d2d69753957b76d4dca05cac497221ff85"}],"database_specific":{"cpe":"cpe:2.3:a:oracle:graalvm:22.3.0:*:*:*:enterprise:*:*:*","extracted_events":[{"introduced":"22.3.0"},{"last_affected":"22.3.0"}],"source":"CPE_STRING"}}],"versions":["22.3.0","vm-22.3.2","vm-22.3.1","vm-22.3.0","vm-22.2.0","vm-21.3.3.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-21938.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/openjdk/jdk","events":[{"introduced":"6412341d454eee8a151cf89b51cabfb7b3d87140"},{"last_affected":"82749901b1497f524e53e47c45708c8e4a63c8b9"}],"database_specific":{"cpe":["cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:20:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8-update101"},{"last_affected":"8-update101"},{"introduced":"8-update102"},{"last_affected":"8-update102"},{"introduced":"8-update11"},{"last_affected":"8-update11"},{"introduced":"8-update111"},{"last_affected":"8-update111"},{"introduced":"8-update112"},{"last_affected":"8-update112"},{"introduced":"8-update20"},{"last_affected":"8-update20"},{"introduced":"8-update25"},{"last_affected":"8-update25"},{"introduced":"8-update31"},{"last_affected":"8-update31"},{"introduced":"8-update40"},{"last_affected":"8-update40"},{"introduced":"8-update45"},{"last_affected":"8-update45"},{"introduced":"8-update51"},{"last_affected":"8-update51"},{"introduced":"8-update60"},{"last_affected":"8-update60"},{"introduced":"8-update65"},{"last_affected":"8-update65"},{"introduced":"8-update66"},{"last_affected":"8-update66"},{"introduced":"8-update71"},{"last_affected":"8-update71"},{"introduced":"8-update72"},{"last_affected":"8-update72"},{"introduced":"8-update73"},{"last_affected":"8-update73"},{"introduced":"8-update74"},{"last_affected":"8-update74"},{"introduced":"8-update77"},{"last_affected":"8-update77"},{"introduced":"8-update91"},{"last_affected":"8-update91"},{"introduced":"8-update92"},{"last_affected":"8-update92"},{"introduced":"20"},{"last_affected":"20"}],"source":"CPE_STRING"}}],"versions":["20","8-update101","8-update102","8-update11","8-update111","8-update112","8-update20","8-update25","8-update31","8-update40","8-update45","8-update51","8-update60","8-update65","8-update66","8-update71","8-update72","8-update73","8-update74","8-update77","8-update91","8-update92"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-21938.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/openjdk/jdk15u","events":[{"introduced":"6412341d454eee8a151cf89b51cabfb7b3d87140"},{"last_affected":"22e500e3a917594cd93baaf8b5c7d29360d250d1"}],"database_specific":{"cpe":["cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8-update101"},{"last_affected":"8-update101"},{"introduced":"8-update102"},{"last_affected":"8-update102"},{"introduced":"8-update11"},{"last_affected":"8-update11"},{"introduced":"8-update111"},{"last_affected":"8-update111"},{"introduced":"8-update112"},{"last_affected":"8-update112"},{"introduced":"8-update20"},{"last_affected":"8-update20"},{"introduced":"8-update25"},{"last_affected":"8-update25"},{"introduced":"8-update31"},{"last_affected":"8-update31"},{"introduced":"8-update40"},{"last_affected":"8-update40"},{"introduced":"8-update45"},{"last_affected":"8-update45"},{"introduced":"8-update51"},{"last_affected":"8-update51"},{"introduced":"8-update60"},{"last_affected":"8-update60"},{"introduced":"8-update65"},{"last_affected":"8-update65"},{"introduced":"8-update66"},{"last_affected":"8-update66"},{"introduced":"8-update71"},{"last_affected":"8-update71"},{"introduced":"8-update72"},{"last_affected":"8-update72"},{"introduced":"8-update73"},{"last_affected":"8-update73"},{"introduced":"8-update74"},{"last_affected":"8-update74"},{"introduced":"8-update77"},{"last_affected":"8-update77"},{"introduced":"8-update91"},{"last_affected":"8-update91"},{"introduced":"8-update92"},{"last_affected":"8-update92"}],"source":"CPE_STRING"}}],"versions":["8-update101","8-update102","8-update11","8-update111","8-update112","8-update20","8-update25","8-update31","8-update40","8-update45","8-update51","8-update60","8-update65","8-update66","8-update71","8-update72","8-update73","8-update74","8-update77","8-update91","8-update92"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-21938.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/openjdk/jdk8u","events":[{"introduced":"6412341d454eee8a151cf89b51cabfb7b3d87140"},{"last_affected":"22e500e3a917594cd93baaf8b5c7d29360d250d1"}],"database_specific":{"cpe":["cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8-update101"},{"last_affected":"8-update101"},{"introduced":"8-update102"},{"last_affected":"8-update102"},{"introduced":"8-update11"},{"last_affected":"8-update11"},{"introduced":"8-update111"},{"last_affected":"8-update111"},{"introduced":"8-update112"},{"last_affected":"8-update112"},{"introduced":"8-update121"},{"last_affected":"8-update121"},{"introduced":"8-update131"},{"last_affected":"8-update131"},{"introduced":"8-update20"},{"last_affected":"8-update20"},{"introduced":"8-update25"},{"last_affected":"8-update25"},{"introduced":"8-update31"},{"last_affected":"8-update31"},{"introduced":"8-update40"},{"last_affected":"8-update40"},{"introduced":"8-update45"},{"last_affected":"8-update45"},{"introduced":"8-update51"},{"last_affected":"8-update51"},{"introduced":"8-update60"},{"last_affected":"8-update60"},{"introduced":"8-update65"},{"last_affected":"8-update65"},{"introduced":"8-update66"},{"last_affected":"8-update66"},{"introduced":"8-update71"},{"last_affected":"8-update71"},{"introduced":"8-update72"},{"last_affected":"8-update72"},{"introduced":"8-update73"},{"last_affected":"8-update73"},{"introduced":"8-update74"},{"last_affected":"8-update74"},{"introduced":"8-update77"},{"last_affected":"8-update77"},{"introduced":"8-update91"},{"last_affected":"8-update91"},{"introduced":"8-update92"},{"last_affected":"8-update92"}],"source":"CPE_STRING"}}],"versions":["8-update101","8-update102","8-update11","8-update111","8-update112","8-update121","8-update131","8-update20","8-update25","8-update31","8-update40","8-update45","8-update51","8-update60","8-update65","8-update66","8-update71","8-update72","8-update73","8-update74","8-update77","8-update91","8-update92"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-21938.json"}}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"},{"type":"WEB","url":"https://www.couchbase.com/alerts/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/21xxx/CVE-2023-21938.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21938"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230427-0008/"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240621-0006/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5430"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5478"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2023.html"}],"database_specific":{"cna_assigner":"oracle","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/21xxx/CVE-2023-21938.json","unresolved_ranges":[{"extracted_events":[{"introduced":"Oracle Java SE:8u361"},{"last_affected":"Oracle Java SE:8u361"},{"introduced":"Oracle Java SE:8u361-perf"},{"last_affected":"Oracle Java SE:8u361-perf"},{"introduced":"Oracle Java SE:11.0.18"},{"last_affected":"Oracle Java SE:11.0.18"},{"introduced":"Oracle Java SE:17.0.6"},{"last_affected":"Oracle Java SE:17.0.6"},{"introduced":"Oracle Java SE:20"},{"last_affected":"Oracle Java SE:20"},{"introduced":"Oracle GraalVM Enterprise Edition:20.3.8"},{"last_affected":"Oracle GraalVM Enterprise Edition:20.3.8"},{"introduced":"Oracle GraalVM Enterprise Edition:21.3.4"},{"last_affected":"Oracle GraalVM Enterprise Edition:21.3.4"},{"introduced":"Oracle GraalVM Enterprise Edition:22.3.0"},{"last_affected":"Oracle GraalVM Enterprise Edition:22.3.0"}],"source":"AFFECTED_FIELD"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}