What is CVE-2022-21449?

CVE-2022-21449 is a vulnerability in the implementation of the Elliptic Curve Digital Signature Algorithm, caused by an improper implementation of the signature verification algorithm. Effectively, it causes the nullification of content’s integrity, which is guaranteed by signatures. This may be SSL handshakes, signatures, certificates, etc., should they be using ECDSA.

Who is affected by CVE-2022-21449?

CVE-2022-21449 affects Java versions 15, 16, 17 and 18, according to the original publication. However - Oracle released a statement about patching versions 7, 8 and 11 as well, implying that those versions were also vulnerable. OpenJDK listed the issue as only exploitable on Java 15, 17, 18. It seems that versions older than 15 are not vulnerable to this exact same issue - this can be easily tested by running the original exploit.

Is the JFrog platform vulnerable to CVE-2022-21449?

After conducting a comprehensive internal inspection, we concluded that JFrog DevOps platform is not vulnerable to CVE-2022-21449.

What is the impact of CVE-2022-21449?

An attacker exploiting this vulnerability may be able to intercept (read and alter) encrypted communications, or bypass authentication in some cases. Moreover, in cases where content integrity is validated using ECDSA signatures, the validation process may be compromised.

How can you remediate CVE-2022-21449?

To remediate this Java vulnerability, we recommend upgrading Java to the latest version for each branch: 7u341, 8u331, 11.0.15, 17.03, 18.0.1. As mentioned, it is currently not clear if Java versions earlier than 15 are affected by the exact same issue.

What mitigation options are available for CVE-2022-23943?

In case upgrading Java is impossible, we recommend using another signature algorithm.

Xray Archives

CVE-2022-25845 – Analyzing the Fastjson “Auto Type Bypass” RCE vulnerability

June 14, 2022 Uriya Yavnieli | 11 min read

A few weeks ago, a new version for Fastjson was released (1.2.83) which contains a fix for a security vulnerability that allegedly allows an attacker to execute code on a remote machine. According to several publications, this vulnerability allows an attacker to bypass the “AutoTypeCheck” mechanism in Fastjson and achieve remote code execution. This Fastjson…

Denial of Service Vulnerability in Envoy Proxy – CVE-2022-29225

June 9, 2022 Ori Hollander, JFrog Security Research | 4 min read

The JFrog Security Research team is constantly looking for new and previously unknown software vulnerabilities in popular open-source projects to help improve their security posture. As part of this effort, we recently discovered a denial of service (DoS) vulnerability in Envoy Proxy, a widely used open-source edge and service proxy server, designed for cloud-native applications…

Npm Package Hijacking Through Domain Takeover: How Bad is this “New” Attack?

May 24, 2022 Andrey Polkovnychenko and Shachar Menashe | 11 min read

When relying on a 3rd-party package from a non-commercial entity, there is always the risk of lack of support, especially when it comes to outdated packages and versions. If the package stops being maintained, nobody will implement a new feature we might need or fix a newly-discovered security vulnerability. Consider, for example, CVE-2019-17571. A critical…

JFrog & Industry Leaders Join White House Summit on Open Source Software Security

May 18, 2022 Stephen Chin, VP of Developer Relations, JFrog | 6 min read

There’s no question the volume, sophistication and severity of software supply chain attacks has increased in the last year. In recent months the JFrog Security Research team tracked nearly 20 different open source software supply chain attacks – two of which were zero day threats. This steady barrage of vulnerabilities and malicious packages is driving…

How to Prevent the Next Log4j Style Zero-Day Vulnerability

May 17, 2022 Asaf Karas, Oren Ish-Shalom, Ilya Khivrich | 8 min read

Note: This blog post was previously published on Dark Reading Software testing is notoriously hard. Search Google for CVEs caused by basic CRLF (newline character) issues and you’ll see thousands of entries. Humanity has been able to put a man on the moon, but it hasn’t yet found a proper way to handle line endings…

Scan your software packages for security vulnerabilities with JFrog Xray

May 17, 2022 Robi Nino and Michael Sverdlov | 4 min read

Scanning your packages for security vulnerabilities and license violations with SCA Tools should be done as early as possible in your SDLC, and the earlier the better. This concept is also known as “Shifting Left”, which helps your organization comply with security policies and standards early on in the software development process. As developers, this…

Npm Supply Chain Attack Targets Germany-based Companies with Dangerous Backdoor Malware

May 10, 2022 Andrey Polkovnychenko and Shachar Menashe | 9 min read

Update May 11th: Following the publication of this blog post, a penetration testing company called "Code White" took responsibility for this dependency confusion attack The JFrog Security research team constantly monitors the npm and PyPI ecosystems for malicious packages that may lead to widespread software supply chain attacks. Last month, we shared a widespread npm…

Get Peace of Mind about Security When Deploying Containers from Docker Desktop

May 10, 2022 Eyal Ben Moshe | 3 min read

Have you ever deployed Docker containers and hoped they delivered safe software? Would you like to get peace of mind that the contents of your containers are secure and clear of vulnerabilities? With JFrog Xray’s new integration with Docker Desktop Extensions, you will be able to do just that. By scanning for vulnerabilities locally before…

DevSecOps 101 Webinar Series

April 28, 2022 JFrog Team | 2 min read

Security should be embedded into the DevOps workflow by default, but for many organizations, it isn't. Enter "DevSecOps". What is DevSecOps? It is a practice to build more secure applications, secure the software supply chain, and secure cloud and on-prem workloads. It is an essential practice that needs visibility. Our new “DevSecOps 101” webinar series…

CVE-2022-21449 “Psychic Signatures”: Analyzing the New Java Crypto Vulnerability

April 21, 2022 Brian Moussalli, JFrog Security Research Team | 5 min read

A few days ago, security researcher Neil Madden published a blog post, in which he provided details about a newly disclosed vulnerability in Java, CVE-2022-21449 or "Psychic Signatures". This security vulnerability originates in an improper implementation of the ECDSA signature verification algorithm, introduced in Java 15. This vulnerability allows an attacker to potentially intercept communication…

Welcome to the JFrog Blog

Latest from Xray :

GitHub and JFrog Partner To Unify Code and Binaries for DevSecOps