Moderate: java-1.8.0-openjdk security and bug fix update
Summary
ALSA-2023:0208: Moderate: java-1.8.0-openjdk security and bug fix update. Affects java-1.8.0-openjdk versions < 1:1.8.0.362.b09-2.el8_7. Fixed in 1:1.8.0.362.b09-2.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. These packages are used to run Java applications and develop Java software.
Vulnerability Detail
The vulnerability in java-1.8.0-openjdk is due to improper restrictions in CORBA deserialization (Serialization, 8285021) and soundbank URL remote loading (Sound, 8293742). The CORBA deserialization vulnerability (CVE-2023-21830) can be exploited to execute arbitrary code with the privileges of the Java Virtual Machine. The soundbank URL remote loading vulnerability (CVE-2023-21843) allows an attacker to load arbitrary soundbanks remotely, potentially leading to unauthorized access or denial of service.
How To Fix
Minimum fixed version
1:1.8.0.362.b09-2.el8_7
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
The java-1.8.0-openjdk package has been found to have a moderate security vulnerability. It is recommended to update the package to the latest version to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
java-1.8.0-openjdk is a package that provides the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
The CORBA deserialization vulnerability allows an attacker to execute arbitrary code with the privileges of the Java Virtual Machine, potentially leading to remote code execution.
The soundbank URL remote loading vulnerability allows an attacker to load arbitrary soundbanks remotely, potentially leading to unauthorized access or denial of service.
To fix the vulnerability, update the java-1.8.0-openjdk package to version 1.8.0.362.b09-2.el8_7 or later.
There are no specific workarounds mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
