Important: java-11-openjdk security update
Summary
ALSA-2021:2781: Important: java-11-openjdk security update. Affects java-11-openjdk-demo-fastdebug versions < 1:11.0.12.0.7-0.el8_4. Fixed in 1:11.0.12.0.7-0.el8_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. These packages are used for running Java applications and developing Java software. The OpenJDK 11 is a widely used version of the Java platform, offering various features and improvements.
Vulnerability Detail
The vulnerability (CVE-2021-2388) in the OpenJDK 11 Java Runtime Environment allows for an incorrect comparison during range check elimination. This vulnerability could be exploited by an attacker to bypass certain security measures and potentially execute arbitrary code. Another vulnerability (CVE-2021-2341) in the OpenJDK 11 Networking component allows an attacker to manipulate the FTP PASV command response, leading to the FtpClient connecting to an arbitrary host. Additionally, a vulnerability (CVE-2021-2369) in the OpenJDK 11 Library component results in incorrect verification of JAR files with multiple MANIFEST.MF files. These vulnerabilities pose a risk to the security and integrity of Java applications and systems running on the affected OpenJDK 11 versions.
How To Fix
Minimum fixed version
1:11.0.12.0.7-0.el8_4
This is the first release that contains the fix.
sudo dnf update java-11-openjdk-demo-fastdebugTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to address the issues.
Conclusion
It is highly recommended to update the java-11-openjdk packages to the latest version to address these vulnerabilities. Regularly applying security updates is crucial for maintaining the security and integrity of Java applications and systems. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-11-openjdk-demo-fastdebug →
FAQ
OpenJDK 11 is an open-source implementation of the Java Development Kit (JDK) and the Java Runtime Environment (JRE). It provides a platform for running Java applications and developing Java software.
These vulnerabilities can be exploited by attackers to bypass security measures, execute arbitrary code, and potentially compromise the security and integrity of Java applications and systems.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will alert you if your application is affected.
No, there are no known workarounds for these vulnerabilities. It is crucial to apply the security update to mitigate the risk.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and acknowledgments, on the respective CVE pages: CVE-2021-2388, CVE-2021-2341, and CVE-2021-2369.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk-demo-fastdebug.
