Moderate: java-11-openjdk security and bug fix update
Summary
ALSA-2023:4175: Moderate: java-11-openjdk security and bug fix update. Affects java-11-openjdk versions < 1:11.0.20.0.8-2.el8. Fixed in 1:11.0.20.0.8-2.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the java-11-openjdk packages:
-
ZIP file parsing infinite loop (CVE-2023-22036): This vulnerability could allow an attacker to cause a denial of service (DoS) by providing a specially crafted ZIP file that triggers an infinite loop during parsing.
-
Weakness in AES implementation (CVE-2023-22041): This vulnerability could allow an attacker to recover the plaintext of encrypted messages by exploiting weaknesses in the AES encryption algorithm.
-
Improper handling of slash characters in URI-to-path conversion (CVE-2023-22049): This vulnerability could allow an attacker to bypass security restrictions and access files outside the intended directory by using specially crafted URIs.
-
O(n^2) growth via consecutive marks (CVE-2023-25193): This vulnerability exists in the harfbuzz library used by OpenJDK and could allow an attacker to cause a denial of service (DoS) by providing a specially crafted input that triggers excessive memory consumption.
-
HTTP client insufficient file name validation (CVE-2023-22006): This vulnerability could allow an attacker to overwrite arbitrary files on the system by providing a specially crafted file name in an HTTP request.
-
Array indexing integer overflow issue (CVE-2023-22045): This vulnerability could allow an attacker to cause a buffer overflow and execute arbitrary code by providing a specially crafted array index value.
These vulnerabilities have varying levels of severity and impact, ranging from denial of service to arbitrary code execution. It is recommended to update the java-11-openjdk packages to the fixed version to mitigate these vulnerabilities.
How To Fix
Minimum fixed version
1:11.0.20.0.8-2.el8
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the java-11-openjdk packages are affected by multiple security vulnerabilities that could lead to denial of service, arbitrary code execution, and other security risks. It is crucial to update the packages to the fixed version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for java-11-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java software.
These vulnerabilities can have varying impacts, including denial of service (DoS), arbitrary code execution, and bypassing security restrictions. The severity of the impact depends on the specific vulnerability and the context in which it is exploited.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
No specific workarounds have been provided for these vulnerabilities. It is recommended to update the java-11-openjdk packages to the fixed version as soon as possible.
You can find more information about these vulnerabilities, including their CVE identifiers, on the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
