What is RHSA-2022:2137?

RHSA-2022:2137 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: java-1.8.0-openjdk security update

Which CVE IDs does RHSA-2022:2137 cover?

RHSA-2022:2137 covers the following CVE IDs: CVE-2022-21426, CVE-2022-21434, CVE-2022-21443, CVE-2022-21476, CVE-2022-21496. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2022:2137?

RHSA-2022:2137 has a CVSS v3 base score of 7.5, published by Red Hat Product Security.

RHSA-2022:2137HighCVSS 7.5

Red Hat Security Advisory: java-1.8.0-openjdk security update

Vendor

Red Hat Product Security

Published

May 17, 2022

Last Modified

June 25, 2026

🔗 CVE IDs covered (5)

CVE-2022-21426 →CVE-2022-21434 →CVE-2022-21443 →CVE-2022-21476 →CVE-2022-21496 →

📋 Description

CVE-2022-21426 — OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) CVE-2022-21434 — OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672) CVE-2022-21443 — OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) CVE-2022-21476 — OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) CVE-2022-21496 — OpenJDK: URI parsing inconsistencies (JNDI, 8278972)

🔗 References (8)

selfhttps://access.redhat.com/errata/RHSA-2022:2137
externalhttps://access.redhat.com/security/updates/classification/#important
externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2075788
externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2075793
externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2075836
externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2075842
externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2075849
selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2137.json