Security Update for OpenJDK 8: Moderate Vulnerability in java-1.8.0-openjdk
Summary
ALSA-2025:18815: Moderate: java-1.8.0-openjdk security update. Affects java-1.8.0-openjdk versions < 1:1.8.0.472.b08-1.el9.alma.1. Fixed in 1:1.8.0.472.b08-1.el9.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The java-1.8.0-openjdk package provides the OpenJDK 8 Java Runtime Environment and Software Development Kit, which are essential for running and developing Java applications. This package is widely used in various environments, including enterprise applications and web services. The recent security update addresses vulnerabilities that could potentially compromise the integrity and security of Java applications.
Vulnerability Detail
The vulnerabilities identified as CVE-2025-53057 and CVE-2025-53066 pertain to enhancements in path factories and certificate handling within the JDK. These vulnerabilities could allow attackers to exploit weaknesses in the Java environment, potentially leading to unauthorized access or manipulation of sensitive data. The vulnerabilities arise from improper handling of certain inputs, which can be leveraged by malicious actors.
How To Fix
Minimum fixed version
1:1.8.0.472.b08-1.el9.alma.1
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, users can revert to the previous behavior of OpenJDK's FIPS mode by using the following command: '-Dcom.AlmaLinux.fips=false'. This command can be added to the Java options in your application configuration to disable FIPS mode temporarily.
Conclusion
The recent security update for the java-1.8.0-openjdk package addresses critical vulnerabilities that could impact the security of Java applications. Users are strongly encouraged to update to the latest version to mitigate risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
These are identifiers for specific vulnerabilities in the OpenJDK 8 package that affect path factories and certificate handling.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You can use the workaround to disable FIPS mode temporarily until you can apply the security update.
Continuing to use the vulnerable version poses security risks, as attackers could exploit the vulnerabilities. It is recommended to update as soon as possible.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json, helping you maintain security without complex setups.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
