Vulnerability in java-11-openjdk package
Summary
ALBA-2022:0887: java-11-openjdk bug fix and enhancement update. Affects java-11-openjdk versions < 1:11.0.14.1.1-2.el8_5. Fixed in 1:11.0.14.1.1-2.el8_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk package provides the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. It is widely used for developing and running Java applications.
Vulnerability Detail
This vulnerability was found in the java-11-openjdk package. The previous release, 11.0.14, introduced a regression in the HTTP client, causing both the ':authority' and 'Host' header fields to be sent in HTTP/2 requests. This behavior is rejected by some HTTP servers, such as Google's. Additionally, recent changes to the Lightweight Directory Access Protocol (LDAP) implementation in OpenJDK changed the behavior when an authentication failure occurred, trying all available LDAP servers with the same credentials. These issues can lead to compatibility problems and potential security risks.
How To Fix
Minimum fixed version
1:11.0.14.1.1-2.el8_5
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The java-11-openjdk package has a vulnerability that can cause compatibility issues and potential security risks. It is recommended to update the package to the latest version to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for java-11-openjdk →
FAQ
This vulnerability can cause compatibility issues with some HTTP servers and may expose potential security risks in LDAP authentication.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground and it will alert you in real-time.
Yes, updating the java-11-openjdk package to version 11.0.14.1.1-2.el8_5 or later will fix this vulnerability.
No, there are no known workarounds for this vulnerability.
You can find more information about this vulnerability in the AlmaLinux OSV database advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
