Important: java-1.8.0-openjdk security and bug fix update
Summary
ALSA-2024:0265: Important: java-1.8.0-openjdk security and bug fix update. Affects java-1.8.0-openjdk versions < 1:1.8.0.402.b06-2.el8. Fixed in 1:1.8.0.402.b06-2.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. These packages are commonly used for running Java applications and developing Java software. The vulnerability described in this report affects the java-1.8.0-openjdk package in AlmaLinux 9.
Vulnerability Detail
The vulnerability (CVE-2024-20918) in the java-1.8.0-openjdk package is due to an array out-of-bounds access caused by a missing range check in the C1 compiler. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial of service. Another vulnerability (CVE-2024-20952) involves an issue with RSA padding and a timing side-channel attack against TLS. This could lead to the disclosure of sensitive information or the manipulation of encrypted communications. Additional vulnerabilities include a flaw in the JVM class file verifier (CVE-2024-20919) that allows the execution of unverified bytecode, a range check loop optimization issue (CVE-2024-20921), arbitrary Java code execution in Nashorn (CVE-2024-20926), and logging of digital signature private keys (CVE-2024-20945). These vulnerabilities pose a significant risk to the security and integrity of Java applications running on systems with the affected package.
How To Fix
Minimum fixed version
1:1.8.0.402.b06-2.el8
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the fix provided by the package maintainers.
Conclusion
The java-1.8.0-openjdk package in AlmaLinux 9 is affected by multiple security vulnerabilities. To mitigate the risks associated with these vulnerabilities, it is crucial to update the package to the fixed version provided by the package maintainers. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, disclose sensitive information, manipulate encrypted communications, or log digital signature private keys.
All versions of the java-1.8.0-openjdk package in AlmaLinux 9 are affected.
There are no known exploits for these vulnerabilities at the time of this report.
It is still recommended to update the package as a precautionary measure to ensure the overall security of the system.
More information about these vulnerabilities can be found on the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
