Moderate: java-17-openjdk security and bug fix update

java-17-openjdk Updated 02 Oct 2025

Summary

20/07/2023

Disclosed on

N/A

Severity

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

ALSA-2023:4159: Moderate: java-17-openjdk security and bug fix update. Affects java-17-openjdk versions < 1:17.0.8.0.7-2.el8. Fixed in 1:17.0.8.0.7-2.el8. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. These packages are used for running Java applications and developing Java programs. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.

Vulnerability Detail

This vulnerability affects the java-17-openjdk package. It includes several security fixes that address various issues:

ZIP file parsing infinite loop (CVE-2023-22036): This vulnerability could lead to a denial of service (DoS) attack by causing an infinite loop during ZIP file parsing.
Weakness in AES implementation (CVE-2023-22041): This vulnerability could allow an attacker to exploit weaknesses in the AES encryption algorithm, potentially leading to unauthorized access or data leakage.
Improper handling of slash characters in URI-to-path conversion (CVE-2023-22049): This vulnerability could allow an attacker to manipulate file paths and potentially access or modify sensitive files.
O(n^2) growth via consecutive marks in harfbuzz (CVE-2023-25193): This vulnerability affects the harfbuzz library used by OpenJDK and could lead to excessive memory consumption and potential denial of service.
Insufficient file name validation in HTTP client (CVE-2023-22006): This vulnerability could allow an attacker to manipulate file names and potentially access or overwrite arbitrary files.
Modulo operator array indexing issue (CVE-2023-22044): This vulnerability could lead to an out-of-bounds array access, potentially resulting in memory corruption or arbitrary code execution.
Array indexing integer overflow issue (CVE-2023-22045): This vulnerability could lead to an out-of-bounds array access due to an integer overflow, potentially resulting in memory corruption or arbitrary code execution.

These vulnerabilities have varying levels of severity and potential impact, ranging from denial of service to arbitrary code execution. It is recommended to update the java-17-openjdk package to the fixed version to mitigate these vulnerabilities.

How To Fix

Minimum fixed version

1:17.0.8.0.7-2.el8

This is the first release that contains the fix.

sudo dnf update java-17-openjdk

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Conclusion

The java-17-openjdk package is affected by multiple vulnerabilities that could lead to denial of service, arbitrary code execution, or unauthorized access. It is crucial to update the package to the fixed version to mitigate these vulnerabilities. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for java-17-openjdk →

FAQ

What is OpenJDK?

OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java programs.

What is the impact of these vulnerabilities?

The impact of these vulnerabilities varies, ranging from denial of service to potential arbitrary code execution. It is recommended to update the java-17-openjdk package to the fixed version to mitigate these vulnerabilities.

How can I update the java-17-openjdk package?

To update the java-17-openjdk package, you can use the package manager specific to your operating system. For example, on AlmaLinux 8, you can use the following command: