Moderate: java-1.8.0-openjdk security update
Summary
ALSA-2022:7006: Moderate: java-1.8.0-openjdk security update. Affects java-1.8.0-openjdk versions < 1:1.8.0.352.b08-2.el8_6. Fixed in 1:1.8.0.352.b08-2.el8_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. These packages are commonly used for running Java applications and developing Java software.
Vulnerability Detail
The vulnerability (CVE-2022-21626) in the java-1.8.0-openjdk package allows for excessive memory allocation in X.509 certificate parsing. This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code. Another vulnerability (CVE-2022-21628) allows for an unlimited number of connections in the Lightweight HTTP Server component, which could lead to resource exhaustion. Additionally, the package has vulnerabilities related to improper handling of long NTLM client hostnames (CVE-2022-21619) and insufficient randomization of JNDI DNS port numbers (CVE-2022-21624). These vulnerabilities could be exploited to perform various attacks, including remote code execution, information disclosure, and DoS attacks.
How To Fix
Minimum fixed version
1:1.8.0.352.b08-2.el8_6
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Updating the java-1.8.0-openjdk package to the latest version is crucial to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
These vulnerabilities could allow an attacker to execute arbitrary code, cause a DoS condition, or disclose sensitive information.
Yes, all versions of the java-1.8.0-openjdk package prior to version 1.8.0.352.b08-2.el8_6 are affected.
The CVSS scores for these vulnerabilities have not been provided in the vulnerability details.
Yes, these vulnerabilities can be exploited remotely.
There is no evidence of these vulnerabilities being actively exploited at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
