Important: java-1.8.0-openjdk security update
Summary
ALSA-2023:1908: Important: java-1.8.0-openjdk security update. Affects java-1.8.0-openjdk versions < 1:1.8.0.372.b07-1.el8_7. Fixed in 1:1.8.0.372.b07-1.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. These packages are used for running Java applications and developing Java software.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the OpenJDK 8 Java Runtime Environment and Java Software Development Kit. The vulnerabilities include:
- Improper connection handling during TLS handshake (CVE-2023-21930)
- Swing HTML parsing issue (CVE-2023-21939)
- Incorrect enqueue of references in garbage collector (CVE-2023-21954)
- Certificate validation issue in TLS session negotiation (CVE-2023-21967)
- Missing string checks for NULL characters (CVE-2023-21937)
- Incorrect handling of NULL characters in ProcessBuilder (CVE-2023-21938)
- Missing check for slash characters in URI-to-path conversion (CVE-2023-21968)
These vulnerabilities could allow an attacker to perform various malicious activities, such as bypassing security controls, executing arbitrary code, or causing denial of service.
How To Fix
Minimum fixed version
1:1.8.0.372.b07-1.el8_7
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is important to update the java-1.8.0-openjdk package to address these vulnerabilities and ensure the security of your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
These vulnerabilities could allow an attacker to bypass security controls, execute arbitrary code, or cause denial of service.
At the time of this advisory, there are no known exploits for these vulnerabilities.
In most cases, it is not necessary to restart the system after applying the update. However, if the java-1.8.0-openjdk package is actively being used, it is recommended to restart the affected services or applications to ensure the updated version is loaded.
In general, updating the java-1.8.0-openjdk package should not impact your Java applications. However, it is always recommended to test the update in a non-production environment before applying it to production systems.
You can find more information about these vulnerabilities, including the Common Vulnerabilities and Exposures (CVE) identifiers, on the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
