Important: java-21-openjdk security update
Summary
ALSA-2024:4573: Important: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.4.0.7-1.el8.alma.1. Fixed in 1:21.0.4.0.7-1.el8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. These packages are used for running Java applications and developing Java software. The vulnerability affects the java-21-openjdk package in AlmaLinux 8.
Vulnerability Detail
The vulnerability in the java-21-openjdk package is related to several security issues:
-
RangeCheckElimination array index overflow (CVE-2024-21147): This vulnerability allows an attacker to overflow the array index, potentially leading to arbitrary code execution.
-
Potential UTF8 size overflow (CVE-2024-21131): This vulnerability can be exploited to cause a size overflow in UTF8 encoding, resulting in a denial of service or arbitrary code execution.
-
Excessive symbol length can lead to infinite loop (CVE-2024-21138): This vulnerability allows an attacker to create a symbol with an excessive length, causing an infinite loop and denial of service.
-
Range Check Elimination (RCE) pre-loop limit overflow (CVE-2024-21140): This vulnerability can be exploited to overflow the pre-loop limit in Range Check Elimination, potentially leading to arbitrary code execution.
-
Out-of-bounds access in 2D image handling (CVE-2024-21145): This vulnerability allows an attacker to access out-of-bounds memory in 2D image handling, potentially leading to information disclosure or arbitrary code execution.
How To Fix
Minimum fixed version
1:21.0.4.0.7-1.el8.alma.1
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
The java-21-openjdk package in AlmaLinux 8 is affected by multiple security vulnerabilities. It is crucial to update the package to version 1:21.0.4.0.7-1.el8.alma.1 or later to mitigate the risks associated with these vulnerabilities.
See every vulnerability recorded for java-21-openjdk →
FAQ
These vulnerabilities can potentially allow an attacker to execute arbitrary code, cause denial of service, disclose sensitive information, or create an infinite loop.
There is no information provided about known exploits for these vulnerabilities at the moment.
Yes, all versions of the java-21-openjdk package prior to 1:21.0.4.0.7-1.el8.alma.1 are affected by these vulnerabilities.
A system restart is not required after applying the update for the java-21-openjdk package.
More information about these vulnerabilities can be found in the CVE pages listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
