{"vulnerability": "cve-2022-21449", "sightings": [{"uuid": "8fe47686-e471-4be5-bb45-a70f402135d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://gist.github.com/Psynosaur/7a31ba2c0d1286e1daf3686d35f77e10", "content": "", "creation_timestamp": "2025-07-06T11:40:25.000000Z"}, {"uuid": "82b7bd0e-edd7-4d20-bc44-92e03b0fcec1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://gist.github.com/tauzen/e0a07a80095b49f1c46cdc8d09e52264", "content": "", "creation_timestamp": "2025-08-13T20:55:04.000000Z"}, {"uuid": "b082e9a7-f985-4c86-b32d-09a745cee8be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_7/2022", "content": "", "creation_timestamp": "2022-04-21T08:54:22.000000Z"}, {"uuid": "a04ea2bb-2807-4039-ab9a-55c9c86f2e70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/cKure/9414", "content": "Zero-Day in Java: A researcher has released proof-of-concept (PoC) code for a digital signature bypass vulnerability in Java.\n\nCVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server.\n\nhttps://github.com/khalednassar/CVE-2022-21449-TLS-PoC", "creation_timestamp": "2022-04-23T19:38:31.000000Z"}, {"uuid": "297e9217-683e-4e9a-996d-acd346e4ade6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2002", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aDemos the Psychic Signatures vulnerability (CVE-2022-21449)\nURL\uff1ahttps://github.com/marschall/psychic-signatures\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-04-21T16:31:55.000000Z"}, {"uuid": "8b4d5397-7422-4ac9-9bdc-4a03a97c737f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1990", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-21449 Vulnerability tester\nURL\uff1ahttps://github.com/jmiettinen/CVE-2022-21449-vuln-test\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-04-20T11:59:27.000000Z"}, {"uuid": "dc752f0a-996b-484d-a296-c0291572b44e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2041", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aTest tool to demonstrate the vulnerability of CVE-2022-21449\nURL\uff1ahttps://github.com/Damok82/SignChecker\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-04-25T16:41:34.000000Z"}, {"uuid": "0bfabe19-ff88-4248-b0bd-1259338ff4fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1991", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-21449 Proof of Concept demonstrating its usage with a vulnerable client and a malicious TLS server\nURL\uff1ahttps://github.com/khalednassar/CVE-2022-21449-TLS-PoC\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-04-20T20:40:33.000000Z"}, {"uuid": "76636fc3-205d-48d5-ac3e-a494bc852f63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2026", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aZeek script to detect exploitation attempts of CVE-2022-21449 for TLS connections\nURL\uff1ahttps://github.com/thack1/CVE-2022-21449\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-04-24T11:07:19.000000Z"}, {"uuid": "140cb590-07e4-4393-b71f-19ad4c0c7282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/RedPillDealer4833/18943", "content": "Better patch up.\nhttps://securityaffairs.co/wordpress/130522/security/poc-java-vulnerability-cve-2022-21449.html", "creation_timestamp": "2022-04-24T03:48:42.000000Z"}, {"uuid": "58d2e918-1e8f-48be-9c40-a62a4f27f26e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/ckuRED/133", "content": "Zero-Day in Java: A researcher has released proof-of-concept (PoC) code for a digital signature bypass vulnerability in Java.\n\nCVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server.\n\nhttps://github.com/khalednassar/CVE-2022-21449-TLS-PoC", "creation_timestamp": "2022-04-23T19:38:24.000000Z"}, {"uuid": "0fe75579-ac6f-4803-a6c1-be5abd0d6838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/poxek/1443", "content": "\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 Oracle \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Java\n\n\u0422\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u043e \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0435\u0436\u0435\u043a\u0432\u0430\u0440\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Oracle. \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 CVE-2022-21449, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438. \u041e\u043d\u0430 \u043d\u0430\u0431\u0440\u0430\u043b\u0430 \u0446\u0435\u043b\u044b\u0445 7,5 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS. \u041e\u0434\u043d\u0430\u043a\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043e\u0446\u0435\u043d\u0438\u043b \u0431\u044b \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043d\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u00ab\u0438\u0437-\u0437\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0441\u043f\u0435\u043a\u0442\u0440\u0430 \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c\u00bb.\n\n\u041b\u0435\u0433\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Oracle Java SE, Oracle GraalVM Enterprise Edition. \u0423\u0441\u043f\u0435\u0448\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e, \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043b\u0438 \u043a\u043e \u0432\u0441\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c Oracle Java SE, Oracle GraalVM Enterprise Edition. \u041f\u043e \u0441\u0443\u0442\u0438, \u044d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u0447\u0442\u043e \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c\u0438.\n\n\u0410\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0430\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0432\u0448\u0435\u0433\u043e, \u0445\u0435\u0448\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438 \u0434\u0432\u0443\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u0445 ECDSA r \u0438 s. \u041f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u043a\u043e\u0433\u0434\u0430 \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0432\u043d\u044b. \u041d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 Java 15, \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0440\u0430\u0432\u043d\u044b \u043b\u0438 \u044d\u0442\u0438 r \u0438 s \u043d\u0443\u043b\u044e, \u0438 \u0438\u043c\u0435\u043d\u043d\u043e \u0437\u0434\u0435\u0441\u044c \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b. \u0415\u0441\u043b\u0438 r \u0438 s \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0430\u0432\u043d\u044b\u043c\u0438 \u043d\u0443\u043b\u044e, \u0442\u043e \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0438\u0445 \u0434\u043b\u044f \u0443\u043c\u043d\u043e\u0436\u0435\u043d\u0438\u044f, \u0431\u0443\u0434\u0443\u0442 \u043e\u0431\u043d\u0443\u043b\u0435\u043d\u044b, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u044f \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0441\u0442\u0438\u043d\u043d\u043e\u0435 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 0 = 0. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u043f\u0443\u0441\u0442\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e (\u043f\u043e\u043b\u043d\u043e\u0439 \u043d\u0443\u043b\u0435\u0439) \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d.\n\n\u041d\u0435\u0434\u043e\u0431\u0440\u043e\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c (\u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c) \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0432 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 ECDSA, \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d. \n\n\u0427\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Java, \u043c\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Java \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438. \u0421\u0430\u043c\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Java: Java 17 (\u0434\u043e\u043b\u0433\u043e\u0441\u0440\u043e\u0447\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430) \u0430 \u0442\u0430\u043a\u0436\u0435 Java 18, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043e 17.0.3 \u0430 \u0442\u0430\u043a\u0436\u0435 18.0.1 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e. \u0411\u043e\u043b\u0435\u0435 \u0441\u0442\u0430\u0440\u044b\u0435, \u043d\u043e \u0432\u0441\u0435 \u0435\u0449\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b Java 7, Java 8 \u0430 \u0442\u0430\u043a\u0436\u0435 Java 11, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7u341, \u0432\u0435\u0440\u0441\u0438\u044f 8u331 \u0430 \u0442\u0430\u043a\u0436\u0435 11.0.15 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e.\n@NeKaspersky", "creation_timestamp": "2022-05-01T11:27:04.000000Z"}, {"uuid": "b4889e31-480f-460e-aebb-a869a5843ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1464", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f Security Labs Research and Proof of Concept Code\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0438 \u043f\u0440\u0438\u043c\u0435\u0440 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 JWT (CVE-2022-21449) \nhttps://github.com/DataDog/security-labs-pocs/\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-05-03T13:01:18.000000Z"}, {"uuid": "2906ff3d-b420-4774-8449-4c8e123048d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/technical_private_cat/236", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u0442\u0435\u0431\u0435 \u043c\u043e\u044f \u0410\u043b\u0438\u0441\u0430.\ud83c\udf80\u2728\n\n\u0412\u043e\u0442 \u0442\u0435\u0431\u0435  \u0437\u0430\u0431\u0430\u0432\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c  \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435 Oracle Java SE, Oracle GraalVM Enterprise Edition \u0434\u043b\u044f Oracle Java SE - CVE-2022-21449 \n\n\u0414\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0440\u0435\u0434\u0438\u0441\u043b\u043e\u0432\u0438\u0435 \u2728\n\nECDSA \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0432\u0441\u0435\u0445 \u0432\u0438\u0434\u043e\u0432 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\u041f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441\u043e \u0441\u0442\u0430\u0440\u044b\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u043c RSA \u043a\u043b\u044e\u0447\u0438 \u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043d\u0430 \u044d\u043b\u043b\u0438\u043f\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u0440\u0438\u0432\u044b\u0445, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043d\u0430\u043c\u043d\u043e\u0433\u043e \u043c\u0435\u043d\u044c\u0448\u0435 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u044d\u043a\u0432\u0438\u0432\u0430\u043b\u0435\u043d\u0442\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u043e\u043d\u0438 \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0442\u0435\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u0440\u0430\u0437\u043c\u0435\u0440 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\ud83d\ude43\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WebAuthn \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0432\u044b\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u0437 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0441\u043f\u0435\u043a\u0442\u0440\u0430 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043d\u043e \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0438 ECDSA (\u0437\u0430\u043c\u0435\u0442\u043d\u044b\u043c \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f Windows Hello, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f RSA). \u041f\u043e\u0434\u043f\u0438\u0441\u0438.\n\nECDSA \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439, \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0445 r \u0438 s . \n\u0427\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044c ECDSA , \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0435 r , s , \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0432\u0448\u0435\u0433\u043e \u0438 \u0445\u044d\u0448 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f. \u0415\u0441\u043b\u0438 \u0434\u0432\u0435 \u0447\u0430\u0441\u0442\u0438 \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0432\u043d\u044b, \u0442\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0430, \u0432 \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u043d\u0430 \u043e\u0442\u043a\u043b\u043e\u043d\u044f\u0435\u0442\u0441\u044f. \n\n\u041e\u0434\u043d\u0430 \u0447\u0430\u0441\u0442\u044c \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0432\u043d\u0430 r , \u0430 \u0434\u0440\u0443\u0433\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0443\u043c\u043d\u043e\u0436\u0430\u0435\u0442\u0441\u044f \u043d\u0430 r \u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0435 \u0438\u0437 s . \u0422\u0430\u043a \u0447\u0442\u043e, \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u043e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u043f\u043b\u043e\u0445\u043e, \u0435\u0441\u043b\u0438 \u0431\u044b r \u0438 s \u0431\u044b\u043b\u0438 \u0440\u0430\u0432\u043d\u044b 0, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0442\u043e\u0433\u0434\u0430 \u0432\u044b \u0431\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b\u0438, \u0447\u0442\u043e 0 = 0 \u2a09 [\u043a\u0443\u0447\u0430 \u0432\u0435\u0449\u0435\u0439] , \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u0442\u0438\u043d\u043d\u044b\u043c \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f [\u043a\u0443\u0447\u0430 \u0432\u0435\u0449\u0435\u0439]. ] ! \u0418 \u044d\u0442\u0430 \u043a\u0443\u0447\u0430 \u0432\u0435\u0449\u0435\u0439 \u2014 \u0432\u0430\u0436\u043d\u044b\u0435 \u0431\u0438\u0442\u044b, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447. \n\u0412\u043e\u0442 \u043f\u043e\u0447\u0435\u043c\u0443 \u0441\u0430\u043c\u0430\u044f \u043f\u0435\u0440\u0432\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 ECDSA \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e r \u0438 s \u043e\u0431\u0430 >= 1.\n\nJava \u0437\u0430\u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 ECDSA \u0432 Java \u0433\u0440\u0443\u0431\u043e \u0433\u043e\u0432\u043e\u0440\u044f \u043e\u043d\u0430 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b\u0430, \u0440\u0430\u0432\u043d\u044b \u043b\u0438 r \u0438\u043b\u0438 s \u043d\u0443\u043b\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u043d\u0438 \u043e\u0431\u0430 \u0440\u0430\u0432\u043d\u044b 0 \ud83d\ude36\u200d\ud83c\udf2b\ufe0f, \u0438 Java \u043f\u0440\u0438\u043c\u0435\u0442 \u0435\u0433\u043e \u043a\u0430\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f. \n\n\u0412\u043e\u0442 \u0441\u0442\u0430\u0442\u044c\u044f \u0441 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u0442\u044b\u043a \n\u0412\u043e\u0442 \u0441\u043a\u0430\u043d\u0435\u0440 \u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f:\n\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043d\u0430 go \u0442\u044b\u043a\n\u0421\u043a\u0430\u043d\u0435\u0440 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430 python \u0442\u044b\u043a\n\u0411\u0443\u0434\u044c\u0442\u0435 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u044b \u043f\u0440\u0438  \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 java  \u0432\u0441\u0435\u0433\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0439\u0442\u0435 \u043a\u043e\u0434 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\ud83d\ude43\n\n\u0410 \u043d\u0430 \u044d\u0442\u043e \u0432\u0441\u0435 . \u0421\u043f\u0430\u0441\u0438\u0431\u043e \u0437\u0430 \u043f\u0440\u043e\u0447\u0442\u0435\u043d\u0438\u0435. \u2764\ufe0f\n\u0410 \u0442\u0435\u0431\u0435 \u0434\u043e\u0440\u043e\u0433\u0430\u044f \u0410\u043b\u0438\u0441\u0430 , \u0443\u0434\u0430\u0447\u043d\u043e\u0439 \u0438\u0433\u0440\u044b \u0432 \u043a\u0440\u043e\u043a\u0435\u0442 \u0441 \u0427\u0435\u0448\u0438\u0440\u0441\u043a\u0438\u043c \u043a\u043e\u0442\u043e\u043c\ud83d\udc08\n#cryptography #cve #scanners #java", "creation_timestamp": "2022-10-13T14:35:14.000000Z"}, {"uuid": "e43683dd-c61d-41a4-85c5-131a8de06769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/technical_private_cat/237", "content": "Hello, my Alice .\ud83c\udf80\u2728\n\nHere's a fun vulnerability in the Oracle Java SE product, Oracle GraalVM Enterprise Edition for Oracle Java SE - CVE-2022-21449 \n\nTo begin with a preface \u2728\n\nECDSA is a widely used standard for signing all kinds of digital documents.\nCompared to the older RSA standard, elliptic curve keys and signatures tend to be much smaller for equivalent security, resulting in their widespread use where size matters\ud83d\ude43\nFor example, the WebAuthn standard for two-factor authentication allows device manufacturers to choose from a wide range of signature algorithms, but in practice almost all devices manufactured now support only ECDSA signatures (a notable exception is Windows Hello, which uses RSA). Signatures.\n\nECDSA consists of two values called r and s . \nTo verify an ECDSA signature, the verifier checks an equation that includes r , s , the signer's public key, and the message hash. If the two parts of the equation are equal, the signature is valid, otherwise it is rejected. \n\nOne part of the equation is equal to r , and the other part is multiplied by r and the value obtained from s . So obviously it would be very bad if r and s were equal to 0, because then you would be checking that 0 = 0 \u2a09 [a bunch of stuff] , which would be true regardless of the value of [a bunch of stuff] . ] ! And that pile of things are important bits, such as the message and the public key. \nThat's why the very first check in the ECDSA checking algorithm is to make sure that r and s are both >= 1.\n\nJava forgot to do an implementation of ECDSA signature checking in Java roughly it didn't check if r or s were equal to zero, so you can create a signature value where they are both 0 \ud83d\ude36\u200d\ud83c\udf2b\ufe0f and Java will accept it as a valid signature for any message and for any publicly available message. \n\nHere's an article with more details link \nHere is the scanner and confirmation of its use:\nImplementation and acknowledgement on go link\n Scanner for this python vulnerability link\n Be careful when working with java always check the code for vulnerability\ud83d\ude43\n\nAnd that's it . Thanks for reading. \u2764\ufe0f\nAnd to you dear Alice , have a good croquet game with the Cheshire cat\ud83d\udc08\n#cryptography #cve #scanners #java", "creation_timestamp": "2022-10-13T14:35:16.000000Z"}, {"uuid": "00c9469e-bdac-4d81-b35c-3e15a962f488", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/27866", "content": "Bug Bounty Hunter\nExploitation and Sample Vulnerable Application of the JWT Null Signature Vulnerability (CVE-2022-21449) https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app", "creation_timestamp": "2022-04-22T15:46:33.000000Z"}, {"uuid": "43657635-c8f9-49da-9da2-6a1b13b01ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/ARC15INFO/578", "content": "", "creation_timestamp": "2024-08-29T06:24:30.000000Z"}, {"uuid": "7cb7e86e-c5a5-4471-9be4-4099091f05e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/2882", "content": "\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0432 Java.\n\u00a0\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 Java 15, Java 16, Java 17 \u0438\u043b\u0438 Java 18 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043d\u0430 \u044d\u043b\u043b\u0438\u043f\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u0440\u0438\u0432\u044b\u0445 ECDSA,\u00a0\u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430\u00a0\u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439\u00a0\u043f\u043e\u0434\u043f\u0438\u0441\u0438\u00a0\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e.\n\u00a0\nCVE-2022-21449 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,5), \u0432\u043b\u0438\u044f\u0435\u0442 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Java SE \u0438 Oracle GraalVM Enterprise Edition: Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; \u0438 Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1, 22.0.0.2.\n\u00a0\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u041d\u0438\u043b \u041c\u044d\u0434\u0434\u0435\u043d \u0438\u0437 ForgeRock \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430, \u043e\u0442\u043c\u0435\u0442\u0438\u0432, \u0447\u0442\u043e \u0435\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0438\u043f\u044b SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0438 \u0440\u0443\u043a\u043e\u043f\u043e\u0436\u0430\u0442\u0438\u0439 (\u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f), \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0435 JWT, SAML assertions, \u0442\u043e\u043a\u0435\u043d\u044b \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 OIDC \u0438 \u0434\u0430\u0436\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 WebAuthn.\n\n\u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Psychic Signatures \u0432 Java, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0443\u0441\u0442\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u0430\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f. \u0423\u0441\u043f\u0435\u0448\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Psychic Signatures \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043b\u044e\u0431\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c\u0438.\n\u00a0\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0432\u0441\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c, \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 Oracle \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0435\u0436\u0435\u043a\u0432\u0430\u0440\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f (CPU) \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2022 \u0433., \u0430 \u0447\u0442\u043e \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u0435\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0425\u0430\u043b\u0435\u0434\u043e\u043c \u041d\u0430\u0441\u0441\u0430\u0440\u043e\u043c \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0432 Java. \n\u00a0\n\u0422\u0430\u043a \u0447\u0442\u043e \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c\u0441\u044f \u043a OpenJDK \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c Java 15-18 \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0438\u0442\u0441\u044f \u043d\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0432\u043e \u0438\u0437\u0431\u0435\u0436\u0430\u043d\u0438\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.", "creation_timestamp": "2022-04-25T12:27:01.000000Z"}, {"uuid": "f055d9cb-20d7-4971-bb61-789c7cc2c627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/NeKaspersky/2172", "content": "\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 Oracle \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Java\n\n\u0422\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u043e \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0435\u0436\u0435\u043a\u0432\u0430\u0440\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Oracle. \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 CVE-2022-21449, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438. \u041e\u043d\u0430 \u043d\u0430\u0431\u0440\u0430\u043b\u0430 \u0446\u0435\u043b\u044b\u0445 7,5 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS. \u041e\u0434\u043d\u0430\u043a\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043e\u0446\u0435\u043d\u0438\u043b \u0431\u044b \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043d\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u00ab\u0438\u0437-\u0437\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0441\u043f\u0435\u043a\u0442\u0440\u0430 \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c\u00bb.\n\n\u041b\u0435\u0433\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Oracle Java SE, Oracle GraalVM Enterprise Edition. \u0423\u0441\u043f\u0435\u0448\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e, \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043b\u0438 \u043a\u043e \u0432\u0441\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c Oracle Java SE, Oracle GraalVM Enterprise Edition. \u041f\u043e \u0441\u0443\u0442\u0438, \u044d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u0447\u0442\u043e \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c\u0438.\n\n\u0410\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0430\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0432\u0448\u0435\u0433\u043e, \u0445\u0435\u0448\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438 \u0434\u0432\u0443\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u0445 ECDSA r \u0438 s. \u041f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u043a\u043e\u0433\u0434\u0430 \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0432\u043d\u044b. \u041d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 Java 15, \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0440\u0430\u0432\u043d\u044b \u043b\u0438 \u044d\u0442\u0438 r \u0438 s \u043d\u0443\u043b\u044e, \u0438 \u0438\u043c\u0435\u043d\u043d\u043e \u0437\u0434\u0435\u0441\u044c \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b. \u0415\u0441\u043b\u0438 r \u0438 s \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0430\u0432\u043d\u044b\u043c\u0438 \u043d\u0443\u043b\u044e, \u0442\u043e \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0438\u0445 \u0434\u043b\u044f \u0443\u043c\u043d\u043e\u0436\u0435\u043d\u0438\u044f, \u0431\u0443\u0434\u0443\u0442 \u043e\u0431\u043d\u0443\u043b\u0435\u043d\u044b, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u044f \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0441\u0442\u0438\u043d\u043d\u043e\u0435 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 0 = 0. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u043f\u0443\u0441\u0442\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e (\u043f\u043e\u043b\u043d\u043e\u0439 \u043d\u0443\u043b\u0435\u0439) \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d.\n\n\u041d\u0435\u0434\u043e\u0431\u0440\u043e\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c (\u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c) \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0432 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 ECDSA, \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d. \n\n\u0427\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Java, \u043c\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Java \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438. \u0421\u0430\u043c\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Java: Java 17 (\u0434\u043e\u043b\u0433\u043e\u0441\u0440\u043e\u0447\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430) \u0430 \u0442\u0430\u043a\u0436\u0435 Java 18, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043e 17.0.3 \u0430 \u0442\u0430\u043a\u0436\u0435 18.0.1 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e. \u0411\u043e\u043b\u0435\u0435 \u0441\u0442\u0430\u0440\u044b\u0435, \u043d\u043e \u0432\u0441\u0435 \u0435\u0449\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b Java 7, Java 8 \u0430 \u0442\u0430\u043a\u0436\u0435 Java 11, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7u341, \u0432\u0435\u0440\u0441\u0438\u044f 8u331 \u0430 \u0442\u0430\u043a\u0436\u0435 11.0.15 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e.\n@NeKaspersky", "creation_timestamp": "2022-04-26T17:32:48.000000Z"}, {"uuid": "74937e8e-6084-4b4c-bbe1-70ff410d0b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/2349", "content": "CVE-2022-21449: Psychic Signatures in Java\nhttps://neilmadden.blog/2022/04/19/psychic-signatures-in-java/", "creation_timestamp": "2026-08-03T00:04:30.991468Z"}, {"uuid": "e6568185-3614-4d9a-b5b5-f52413c416c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1967", "content": "#CVE-2022\n\nCVE-2022-21449 Proof of Concept demonstrating its usage with a vulnerable client and a malicious TLS server\n\nhttps://github.com/khalednassar/CVE-2022-21449-TLS-PoC\n\n@BlueRedTeam", "creation_timestamp": "2022-04-21T08:41:01.000000Z"}, {"uuid": "290e0f71-2397-44d8-bb82-29d35c540587", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1973", "content": "#exploit\n\n+ CVE-2022-21449:\n\"Psychic Signatures\"\nPoC demonstrating its usage with a vulnerable client and a malicious TLS server\nhttps://github.com/khalednassar/CVE-2022-21449-TLS-PoC\n\n+  CVE-2022-21449:\nExploitation and Sample Vulnerable Application of the JWT Null Signature Vulnerability\nhttps://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app\n\n@BlueRedTeam", "creation_timestamp": "2022-04-22T08:42:47.000000Z"}, {"uuid": "41df1e8e-0e90-4d83-8de2-ef85f739ba56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/canyoupwnme/6784", "content": "CVE-2022-21449: Psychic Signatures in Java\nhttps://neilmadden.blog/2022/04/19/psychic-signatures-in-java/", "creation_timestamp": "2022-04-20T21:18:28.000000Z"}, {"uuid": "466df132-dad5-4f6f-b46f-8fc1aa491bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/thebugbountyhunter/6188", "content": "CVE-2022-21449: Psychic Signatures in Java\n\nhttps://neilmadden.blog/2022/04/19/psychic-signatures-in-java/", "creation_timestamp": "2022-04-21T10:20:36.000000Z"}, {"uuid": "9c17a190-8923-4f08-92cb-5e3b34d00f35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/64", "content": "https://github.com/khalednassar/CVE-2022-21449-TLS-PoC", "creation_timestamp": "2022-04-24T07:07:26.000000Z"}, {"uuid": "098730c6-615a-4cf4-8fc4-c967d0e4326e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5856", "content": "#exploit\n1. CVE-2022-21449:\n\"Psychic Signatures\"\nPoC demonstrating its usage with a vulnerable client and a malicious TLS server\nhttps://github.com/khalednassar/CVE-2022-21449-TLS-PoC\n\n2. CVE-2022-21449:\nExploitation and Sample Vulnerable Application of the JWT Null Signature Vulnerability\nhttps://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app", "creation_timestamp": "2022-04-22T11:01:07.000000Z"}, {"uuid": "dcfb0052-9f9b-4a17-8344-36dc335e29de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/486", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-21449\nGithub: https://github.com/Skipper7718/CVE-2022-21449-showcase\nDescribe: \nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "creation_timestamp": "2026-08-02T00:01:13.084090Z"}, {"uuid": "f8d07f7c-44f2-4925-8ee2-57cf9b9b2c17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/486", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-21449\nGithub: https://github.com/Skipper7718/CVE-2022-21449-showcase\nDescribe: \nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "creation_timestamp": "2026-08-01T07:00:04.509304Z"}, {"uuid": "0a58b13b-8fae-4842-ac81-0921e3a86976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/devsecops_weekly/445", "content": "Security Labs Research \u043e\u0442 Datadog\n\n\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0420\u0435\u0431\u044f\u0442\u0430 \u0438\u0437 Datadog \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u044b\u0445 \u0440\u0430\u0431\u043e\u0442, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0445 Security.\n\n\u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0430\u0431\u043e\u0440 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f \u0442\u043e\u043b\u044c\u043a\u043e:\n\ud83c\udf6d Dirty Pipe Container Breakout\n\ud83c\udf6d \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-21449\n\ud83c\udf6d Spring Core RCE (Spring4shell)\n\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, PoC \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e exploit, \u043d\u0430\u0431\u043e\u0440 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0448\u0430\u0433\u043e\u0432 \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u041d\u0430\u0434\u0435\u0435\u043c\u0441\u044f, \u0447\u0442\u043e \u00ab\u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0430\u00bb \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0442\u044c\u0441\u044f \u0438 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u043c \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445.", "creation_timestamp": "2026-08-14T16:00:22.984856Z"}, {"uuid": "6f918fd0-29f7-49d3-a27e-c2d40fe40eb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/devsecops_weekly/445", "content": "Security Labs Research \u043e\u0442 Datadog\n\n\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0420\u0435\u0431\u044f\u0442\u0430 \u0438\u0437 Datadog \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u044b\u0445 \u0440\u0430\u0431\u043e\u0442, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0445 Security.\n\n\u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0430\u0431\u043e\u0440 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f \u0442\u043e\u043b\u044c\u043a\u043e:\n\ud83c\udf6d Dirty Pipe Container Breakout\n\ud83c\udf6d \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-21449\n\ud83c\udf6d Spring Core RCE (Spring4shell)\n\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, PoC \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e exploit, \u043d\u0430\u0431\u043e\u0440 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0448\u0430\u0433\u043e\u0432 \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u041d\u0430\u0434\u0435\u0435\u043c\u0441\u044f, \u0447\u0442\u043e \u00ab\u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0430\u00bb \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0442\u044c\u0441\u044f \u0438 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u043c \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445.", "creation_timestamp": "2026-08-15T00:00:46.801004Z"}, {"uuid": "97a6745f-e315-4f04-bdd2-1db0a5c71569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "published-proof-of-concept", "source": "https://t.me/devsecops_weekly/445", "content": "Security Labs Research \u043e\u0442 Datadog\n\n\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0420\u0435\u0431\u044f\u0442\u0430 \u0438\u0437 Datadog \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u044b\u0445 \u0440\u0430\u0431\u043e\u0442, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0445 Security.\n\n\u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0430\u0431\u043e\u0440 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f \u0442\u043e\u043b\u044c\u043a\u043e:\n\ud83c\udf6d Dirty Pipe Container Breakout\n\ud83c\udf6d \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-21449\n\ud83c\udf6d Spring Core RCE (Spring4shell)\n\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, PoC \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e exploit, \u043d\u0430\u0431\u043e\u0440 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0448\u0430\u0433\u043e\u0432 \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u041d\u0430\u0434\u0435\u0435\u043c\u0441\u044f, \u0447\u0442\u043e \u00ab\u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0430\u00bb \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0442\u044c\u0441\u044f \u0438 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u043c \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445.", "creation_timestamp": "2026-08-16T00:00:49.169391Z"}, {"uuid": "112f80a1-4486-40b8-99d7-974d011e6275", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-214497", "type": "seen", "source": "https://t.me/xhqcankao/2799", "content": "Oracle \u4e0a\u5468\u4fee\u8865\u4e86 Java 15 \u53ca\u66f4\u9ad8\u7248\u672c\u4e2d\u7684\u4e00\u4e2a\u4e25\u91cd\u9519\u8bef\uff0c\u8be5\u9519\u8bef\u4f7f\u653b\u51fb\u8005\u53ef\u4ee5\u4f2a\u9020 TLS \u8bc1\u4e66\u548c\u7b7e\u540d\u3001\u53cc\u56e0\u7d20\u8eab\u4efd\u9a8c\u8bc1\u6d88\u606f\u7b49\n\n\u4f7f\u7528\u7532\u9aa8\u6587\u8f83\u65b0\u7248\u672c\u7684 Java \u6846\u67b6\u7684\u7ec4\u7ec7\u5728\u4e0a\u5468\u4e09\u6536\u5230\u63d0\u9192\u3002\u4e00\u4e2a\u5173\u952e\u7684\u6f0f\u6d1e\u53ef\u4ee5\u4f7f\u9ed1\u5ba2\u5f88\u5bb9\u6613\u4f2a\u9020TLS\u8bc1\u4e66\u548c\u7b7e\u540d\u3001\u53cc\u56e0\u7d20\u8ba4\u8bc1\u4fe1\u606f\u4ee5\u53ca\u7531\u4e00\u7cfb\u5217\u5e7f\u6cdb\u4f7f\u7528\u7684\u5f00\u653e\u6807\u51c6\u4ea7\u751f\u7684\u6388\u6743\u51ed\u8bc1\u3002\n\n\u7532\u9aa8\u6587\u516c\u53f8\u4e0a\u5468\u4e8c\u4fee\u8865\u4e86\u8fd9\u4e2a\u6f0f\u6d1e\uff0c\u5b83\u5f71\u54cd\u5230\u8be5\u516c\u53f8\u5728Java 15\u53ca\u4ee5\u4e0a\u7248\u672c\u4e2d\u5bf9\u692d\u5706\u66f2\u7ebf\u6570\u5b57\u7b7e\u540d\u7b97\u6cd5\u7684\u5b9e\u73b0\u3002ECDSA\u662f\u4e00\u79cd\u5229\u7528\u692d\u5706\u66f2\u7ebf\u5bc6\u7801\u5b66\u539f\u7406\u5bf9\u4fe1\u606f\u8fdb\u884c\u6570\u5b57\u8ba4\u8bc1\u7684\u7b97\u6cd5\u3002\u4e0eRSA\u6216\u5176\u4ed6\u52a0\u5bc6\u7b97\u6cd5\u76f8\u6bd4\uff0cECDSA\u7684\u4e00\u4e2a\u5173\u952e\u4f18\u52bf\u662f\u5b83\u751f\u6210\u7684\u5bc6\u94a5\u89c4\u6a21\u8f83\u5c0f\uff0c\u8fd9\u4f7f\u5f97\u5b83\u975e\u5e38\u9002\u5408\u7528\u4e8e\u5305\u62ec\u57fa\u4e8eFIDO\u76842FA\u3001\u5b89\u5168\u65ad\u8a00\u6807\u8bb0\u8bed\u8a00\u3001OpenID\u548cJSON\u7b49\u6807\u51c6\u3002\n\n\u8be5\u6f0f\u6d1e\u88ab\u8ffd\u8e2a\u4e3aCVE-2022-21449\uff0c\u5176\u4e25\u91cd\u6027\u8bc4\u7ea7\u4e3a7.5\uff08\u6ee1\u520610\u5206\uff09\uff0c\u4f46Madden\u8bf4\uff0c\u6839\u636e\u4ed6\u7684\u8bc4\u4f30\uff0c\u4ed6\u5c06\u5176\u4e25\u91cd\u6027\u8bc4\u7ea7\u4e3a10\u5206\uff0c\"\u56e0\u4e3a\u5728\u8bbf\u95ee\u7ba1\u7406\u80cc\u666f\u4e0b\u5bf9\u4e0d\u540c\u529f\u80fd\u7684\u5f71\u54cd\u8303\u56f4\u5f88\u5e7f\"\u3002\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u88ab\u8106\u5f31\u7f51\u7edc\u4e4b\u5916\u7684\u4eba\u5229\u7528\uff0c\u6839\u672c\u4e0d\u9700\u8981\u9a8c\u8bc1\u3002\n\n\u2014\u2014 arstechnica", "creation_timestamp": "2026-08-24T08:00:03.236579Z"}, {"uuid": "cd2338f0-cc80-4aed-8ccb-173d6948dfee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/CVEhub/486", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-21449\nGithub: https://github.com/Skipper7718/CVE-2022-21449-showcase\nDescribe: \nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "creation_timestamp": "2026-07-29T12:01:06.114310Z"}, {"uuid": "26077ff1-eddf-4045-a455-d7c7fb965c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/reverseame/2349", "content": "CVE-2022-21449: Psychic Signatures in Java\nhttps://neilmadden.blog/2022/04/19/psychic-signatures-in-java/", "creation_timestamp": "2026-07-29T12:02:41.846804Z"}, {"uuid": "f62d5f90-ca20-4b98-9aec-c2b0d94a526b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/CVEhub/486", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-21449\nGithub: https://github.com/Skipper7718/CVE-2022-21449-showcase\nDescribe: \nVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "creation_timestamp": "2026-07-30T00:01:46.503220Z"}, {"uuid": "05dc3741-e4b1-4978-95c6-d42feed2d672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21449", "type": "seen", "source": "https://t.me/reverseame/2349", "content": "CVE-2022-21449: Psychic Signatures in Java\nhttps://neilmadden.blog/2022/04/19/psychic-signatures-in-java/", "creation_timestamp": "2026-07-30T00:02:36.548417Z"}]}