Moderate: java-17-openjdk security and bug fix update
Summary
ALSA-2023:0192: Moderate: java-17-openjdk security and bug fix update. Affects java-17-openjdk versions < 1:17.0.6.0.10-3.el8_7. Fixed in 1:17.0.6.0.10-3.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
This vulnerability affects the java-17-openjdk package. The vulnerability allows for a denial-of-service (DoS) attack against DTLS connections and enables remote loading of soundbank URLs. The DoS attack can be triggered during the handshake process of DTLS connections, leading to a disruption of service. The remote loading of soundbank URLs can be exploited to load malicious soundbank files, potentially leading to unauthorized access or execution of arbitrary code. These vulnerabilities have been assigned CVE-2023-21835 and CVE-2023-21843 respectively.
How To Fix
Minimum fixed version
1:17.0.6.0.10-3.el8_7
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. It is recommended to apply the security update as soon as possible to mitigate the risk.
Conclusion
The java-17-openjdk package is vulnerable to a DoS attack against DTLS connections and remote loading of soundbank URLs. It is recommended to update the package to version 17.0.6.0.10-3.el8_7 or later to mitigate these vulnerabilities. Applying the security update will ensure the stability and security of Java applications and software developed using OpenJDK. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for java-17-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java software.
A Denial-of-Service (DoS) attack is an attempt to disrupt the normal functioning of a computer network or system by overwhelming it with a flood of illegitimate requests or traffic. In the context of this vulnerability, the DoS attack can be triggered during the handshake process of DTLS connections, leading to a disruption of service.
DTLS (Datagram Transport Layer Security) is a protocol that provides security for datagram-based applications by implementing the Transport Layer Security (TLS) protocol over the User Datagram Protocol (UDP). It is commonly used in applications that require secure communication over unreliable networks, such as Voice over IP (VoIP) and real-time multimedia streaming.
A soundbank URL is a reference to a location (URL) from which a soundbank file can be loaded. Soundbanks are used in Java applications to provide additional sound resources, such as instrument samples or sound effects. The vulnerability allows for the remote loading of soundbank URLs, which can be exploited to load malicious soundbank files.
To update the java-17-openjdk package, you can use package management tools like yum or dnf. Run the appropriate command with administrative privileges to check for available updates and install the latest version of the package.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
