tzdata-java vulnerability: tzdata bug fix and enhancement update
Summary
ALBA-2021:4003: tzdata bug fix and enhancement update. Affects tzdata-java versions < 2021e-1.el8. Fixed in 2021e-1.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tzdata-java is a package that contains data files with rules for various time zones. It is used to manage and update time zone information in Java applications. The package provides accurate and up-to-date time zone data, allowing applications to correctly handle time zone conversions and daylight saving time changes.
Vulnerability Detail
The tzdata-java package has been found to have a vulnerability that is addressed in the latest update (version 2021e). The vulnerability is related to recent time zone changes and includes the following issues:
- The Pacific/Fiji timezone has suspended daylight saving time (DST) for the 2021/2022 season.
- The 'zic -r' command now marks unspecified timestamps with "-00".
- Palestine will end daylight saving time (DST) on October 29, 2021, at 01:00, rather than the predicted October 30, 2021.
These changes may impact applications that rely on accurate time zone information, especially those that handle conversions and scheduling based on time zones.
How To Fix
Minimum fixed version
2021e-1.el8
This is the first release that contains the fix.
sudo dnf update tzdata-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The tzdata-java package has been updated to address the recent time zone changes and fix the mentioned vulnerabilities. It is recommended to update the package to the latest version to ensure accurate time zone handling in your Java applications. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tzdata-java →
FAQ
tzdata-java is a package that provides time zone data files for Java applications. It helps applications handle time zone conversions and daylight saving time changes accurately.
The vulnerability may affect applications that rely on accurate time zone information. It can lead to incorrect time zone conversions and scheduling issues.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
Currently, there is no known workaround for this vulnerability. It is recommended to update the tzdata-java package to the latest version.
For more information about this vulnerability, you can refer to the official advisory on the AlmaLinux GitHub repository: https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALBA-2021:4003.json
Related vulnerabilities
Recent vulnerabilities recorded for tzdata-java.
