Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 2 May 2022 14:53:07 +0200
From: Christian Fischer <>
Subject: Re: CVE-2022-21449 and version reporting

On 01.05.22 16:38, John Helmert III wrote:
> On Sat, Apr 30, 2022 at 09:09:16PM +0200, Christian Fischer wrote:
>> On Saturday, April 30, 2022 17:38 CEST, John Helmert III <> wrote:
>>> On Sat, Apr 30, 2022 at 01:24:36PM +0200, Christian Fischer wrote:
>>>>   > It’s not that they didn’t/can’t verify, it’s already verified,
>>>> they’re claiming those versions no longer being officially supported
>>>> means they can seemingly omit them from CVE reporting.
>>>>   >
>>>>   > Which is dangerous, misleading, and nonsensical.
>>>> While i fully agree with this be aware that CVE entries could generally
>>>> contain incomplete information:
>>>> After requesting an update of a CVE entry via the MITRE CVE forum in the
>>>> past to add additional affected products for a different vendor (which
>>>> wasn't even the assigning CNA like it is the case for Oracle here) my
>>>> request was rejected by MITRE with the following rationale given:
>>> The CNA that assigned that CVE is Oracle, so Oracle is the CNA to talk
>>> to to make changes to it. MITRE won't make changes to it as they're
>>> not the CNA behind that CVE.
>>>>   > A CVE description does not necessarily contain all the affected
>>>> products or versions and is not part of CVE ID requirements. The
>>>> products are documented in the CVE references.
>>>> This is also matching my experiences with various other products /
>>>> vendors and related CVE entries for these.
>>> Right, this is documented in the CNA rules [1]:
>>> "8.2.1 MUST provide enough information for a reader to have a
>>> reasonable understanding of what products are affected. If the
>>> affected products are not explicitly listed in the description, then
>>> the CNA MUST provide a reference that points to the known affected
>>> products."
>>> [1]
>> Yes, indeed / in know (since then) but it wasn't clear if all participants in this thread are aware of this fact.
>> But i just have noticed that my posting was only partly relevant for the quoted message and the question of the OP "Why is this being allowed…" because i have missed that Oracle (if they as the assigning CNA are aware that Java 15 and 16 are affected) AFAICT indeed haven't provided any reference so far about all known affected versions / products.
> Their April 2022 CPU (Critical Patch Update) Advisory, which is a
> reference of CVE-2022-21449, is pretty comprehensive:
> Supported versions affected: "Oracle Java SE: 17.0.2, 18; Oracle
> GraalVM Enterprise Edition: 21.3.1,"

Maybe there is a misunderstanding, just to clarify:

1. Oracle Java 15, 16, 17 and 18 are known to be affected
2. Oracle seems to be aware of this (see the various previous comments / 
the blog post linked by the OP)
3. The CVE description doesn't reflect that Java 15 and 16 is affected 
(only Java 17 and 18 is listed there as vulnerable)
4. The related entry for CVE-2022-21449 on the April 2022 CPU is also 
not reflecting this (only Java 17 and 18 is listed there as vulnerable)

and that's what is currently discussed in this thread.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.