Important: java-11-openjdk security update
Summary
ALSA-2021:3891: Important: java-11-openjdk security update. Affects java-11-openjdk versions < 1:11.0.13.0.8-1.el8_4. Fixed in 1:11.0.13.0.8-1.el8_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used for developing and running Java applications.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the java-11-openjdk package:
-
CVE-2021-35565: A loop in HttpsServer triggered during TLS session close could lead to a denial-of-service attack.
-
CVE-2021-35567: Incorrect principal selection when using Kerberos Constrained Delegation could result in unauthorized access.
-
CVE-2021-35550: Weak ciphers are preferred over stronger ones for TLS, potentially weakening the security of encrypted communications.
-
CVE-2021-35556: Excessive memory allocation in RTFParser in the Swing library could lead to a denial-of-service attack.
-
CVE-2021-35559: Excessive memory allocation in RTFReader in the Swing library could lead to a denial-of-service attack.
-
CVE-2021-35561: Excessive memory allocation in HashMap and HashSet could lead to a denial-of-service attack.
-
CVE-2021-35564: Certificates with end dates too far in the future can corrupt the keystore.
-
CVE-2021-35578: An unexpected exception raised during TLS handshake could lead to a denial-of-service attack.
-
CVE-2021-35586: Excessive memory allocation in BMPImageReader in the ImageIO library could lead to a denial-of-service attack.
-
CVE-2021-35603: Non-constant comparison during TLS handshakes could lead to a denial-of-service attack.
These vulnerabilities have varying impacts and could potentially allow attackers to execute arbitrary code, cause a denial-of-service, or gain unauthorized access.
How To Fix
Minimum fixed version
1:11.0.13.0.8-1.el8_4
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
In conclusion, the java-11-openjdk package is affected by multiple vulnerabilities that could potentially allow attackers to execute arbitrary code, cause a denial-of-service, or gain unauthorized access. It is highly recommended to update the package to the latest version to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-11-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for developing and running Java applications.
These vulnerabilities have varying impacts and could potentially allow attackers to execute arbitrary code, cause a denial-of-service, or gain unauthorized access.
To fix these vulnerabilities, it is recommended to update the java-11-openjdk package to version 1:11.0.13.0.8-1.el8_4 or later. This can be done by running the package manager update command specific to your Linux distribution.
There are no mentioned workarounds for these vulnerabilities.
You can find more information about these vulnerabilities, including their CVE identifiers, on the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
