Moderate: java-17-openjdk security update
Summary
ALSA-2022:0161: Moderate: java-17-openjdk security update. Affects java-17-openjdk versions < 1:17.0.2.0.8-4.el8_5. Fixed in 1:17.0.2.0.8-4.el8_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the java-17-openjdk packages. The vulnerabilities include:
-
Incomplete deserialization class filtering in ObjectInputStream (Serialization, CVE-2022-21248): This vulnerability could allow an attacker to deserialize arbitrary objects and potentially execute malicious code.
-
Incorrect reading of TIFF files in TIFFNullDecompressor (ImageIO, CVE-2022-21277): This vulnerability could lead to memory corruption or denial of service by tricking a user into opening a specially crafted TIFF file.
-
Insufficient URI checks in the XSLT TransformerImpl (JAXP, CVE-2022-21282): This vulnerability could allow an attacker to perform XML External Entity (XXE) attacks and access sensitive information.
-
Unexpected exception thrown in regex Pattern (Libraries, CVE-2022-21283): This vulnerability could lead to denial of service or potential code execution by causing a Java application to crash or enter an infinite loop.
-
Incorrect marking of writeable fields (Hotspot, CVE-2022-21291): This vulnerability could allow an attacker to modify writeable fields in Java objects, potentially leading to unauthorized access or code execution.
-
Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, CVE-2022-21293): This vulnerability could allow an attacker to modify the internal state of StringBuffer and StringBuilder objects during deserialization, potentially leading to code execution.
-
Incorrect IdentityHashMap size checks during deserialization (Libraries, CVE-2022-21294): This vulnerability could allow an attacker to modify the size of IdentityHashMap objects during deserialization, potentially leading to denial of service or code execution.
-
Incorrect access checks in XMLEntityManager (JAXP, CVE-2022-21296): This vulnerability could allow an attacker to bypass access restrictions and perform unauthorized actions.
-
Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, CVE-2022-21299): This vulnerability could lead to denial of service by causing a Java application to enter an infinite loop.
-
Array indexing issues in LIRGenerator (Hotspot, CVE-2022-21305): This vulnerability could allow an attacker to read or write data outside the bounds of an array, potentially leading to information disclosure or code execution.
-
Excessive resource use when reading JAR manifest attributes (Libraries, CVE-2022-21340): This vulnerability could lead to denial of service by causing excessive resource consumption when reading JAR manifest attributes.
-
Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, CVE-2022-21341): This vulnerability could allow an attacker to deserialize exceptions with malicious payloads, potentially leading to code execution.
-
Excessive memory allocation in BMPImageReader (ImageIO, CVE-2022-21360): This vulnerability could lead to denial of service by causing excessive memory allocation when processing BMP images.
-
Integer overflow in BMPImageReader (ImageIO, CVE-2022-21365): This vulnerability could lead to denial of service or potential code execution by causing a Java application to crash or enter an infinite loop due to an integer overflow.
-
Excessive memory allocation in TIFF*Decompressor (ImageIO, CVE-2022-21366): This vulnerability could lead to denial of service by causing excessive memory allocation when processing TIFF images.
These vulnerabilities have varying levels of severity and potential impact, ranging from denial of service to remote code execution. It is recommended to update the java-17-openjdk packages to the fixed version to mitigate these vulnerabilities.
How To Fix
Minimum fixed version
1:17.0.2.0.8-4.el8_5
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the java-17-openjdk packages are affected by multiple vulnerabilities that could lead to various security risks, including remote code execution, denial of service, and information disclosure. It is crucial to update the affected packages to the fixed version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-17-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java software.
The potential impacts of these vulnerabilities include remote code execution, denial of service, memory corruption, information disclosure, and unauthorized access. The severity and specific impact may vary depending on the vulnerability and the context in which the affected packages are used.
You can use vulnerability management tools like Vulert to check if your system is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can also use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to update the java-17-openjdk packages to the fixed version as soon as possible to mitigate the vulnerabilities.
You can find more information about these vulnerabilities, including their CVE identifiers, on the CVE pages listed in the References section of the original vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
