Moderate: java-21-openjdk security and bug fix update
Summary
ALSA-2023:6887: Moderate: java-21-openjdk security and bug fix update. Affects java-21-openjdk versions < 1:21.0.1.0.12-2.el8.alma.1. Fixed in 1:21.0.1.0.12-2.el8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
The java-21-openjdk package is affected by two security vulnerabilities:
-
Memory corruption issue on x86_64 with AVX-512 (CVE-2023-22025): This vulnerability can lead to memory corruption on systems running x86_64 architecture with AVX-512 instructions. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
Certificate path validation issue during client authentication (CVE-2023-22081): This vulnerability affects the certificate path validation process during client authentication. An attacker could exploit this vulnerability to bypass certificate validation and perform man-in-the-middle attacks.
These vulnerabilities pose a moderate risk and could potentially lead to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
1:21.0.1.0.12-2.el8.alma.1
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risks.
Conclusion
The java-21-openjdk package is affected by two security vulnerabilities that could potentially lead to unauthorized access, data breaches, or system compromise. It is crucial to update the package to the latest version to address these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for java-21-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java software.
The memory corruption vulnerability can lead to memory corruption on systems running x86_64 architecture with AVX-512 instructions. This could potentially allow an attacker to execute arbitrary code or cause a denial of service.
The certificate path validation vulnerability affects the process of validating certificates during client authentication. An attacker could exploit this vulnerability to bypass certificate validation and perform man-in-the-middle attacks.
To update the java-21-openjdk package, you can use the package manager of the AlmaLinux 8 operating system. Run the appropriate command for your package manager, such as 'yum update java-21-openjdk' or 'dnf update java-21-openjdk'.
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risks.
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
