Important: java-1.8.0-openjdk security and bug fix update
Summary
ALSA-2023:1909: Important: java-1.8.0-openjdk security and bug fix update. Affects java-1.8.0-openjdk versions < 1:1.8.0.372.b07-1.el9_1. Fixed in 1:1.8.0.372.b07-1.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. These packages are used for running Java applications and developing Java software. The java-1.8.0-openjdk package is vulnerable to multiple security issues and bugs that have been addressed in this update.
Vulnerability Detail
The java-1.8.0-openjdk package is affected by several security vulnerabilities:
-
Improper connection handling during TLS handshake (CVE-2023-21930): This vulnerability could allow an attacker to manipulate the TLS handshake process, leading to potential security breaches.
-
Swing HTML parsing issue (CVE-2023-21939): This vulnerability could allow an attacker to exploit the Swing HTML parsing mechanism, potentially leading to remote code execution.
-
Incorrect enqueue of references in garbage collector (CVE-2023-21954): This vulnerability could allow an attacker to manipulate the garbage collector, leading to potential memory corruption and arbitrary code execution.
-
Certificate validation issue in TLS session negotiation (CVE-2023-21967): This vulnerability could allow an attacker to bypass certificate validation during TLS session negotiation, potentially leading to man-in-the-middle attacks.
-
Missing string checks for NULL characters (CVE-2023-21937): This vulnerability could allow an attacker to manipulate strings containing NULL characters, potentially leading to memory corruption and arbitrary code execution.
-
Incorrect handling of NULL characters in ProcessBuilder (CVE-2023-21938): This vulnerability could allow an attacker to manipulate the ProcessBuilder class, potentially leading to command injection attacks.
-
Missing check for slash characters in URI-to-path conversion (CVE-2023-21968): This vulnerability could allow an attacker to manipulate URI-to-path conversion, potentially leading to path traversal attacks.
These vulnerabilities pose a significant risk to systems running the java-1.8.0-openjdk package and should be addressed immediately.
How To Fix
Minimum fixed version
1:1.8.0.372.b07-1.el9_1
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is strongly advised to apply the recommended fix by updating the java-1.8.0-openjdk package to the latest version.
Conclusion
The java-1.8.0-openjdk package is vulnerable to multiple security issues and bugs. It is crucial to update the package to the latest version to mitigate the risks associated with these vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
These vulnerabilities could allow an attacker to manipulate the TLS handshake process, exploit the Swing HTML parsing mechanism, manipulate the garbage collector, bypass certificate validation, manipulate strings and ProcessBuilder class, and perform path traversal attacks. This could lead to potential security breaches, remote code execution, memory corruption, arbitrary code execution, command injection attacks, and man-in-the-middle attacks.
Yes, all versions of the java-1.8.0-openjdk package are affected by these vulnerabilities. It is recommended to update to the latest version to mitigate the risks.
To update the java-1.8.0-openjdk package, you can use the package manager provided by your operating system. For AlmaLinux, you can use the official AlmaLinux repositories or follow the instructions provided by the package maintainer.
No, there are no known workarounds for these vulnerabilities. It is recommended to apply the recommended fix by updating the java-1.8.0-openjdk package to the latest version.
You can find more information about these vulnerabilities, including the impact, CVSS scores, acknowledgments, and related information, on the respective CVE pages listed in the References section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
