Moderate: java-1.8.0-openjdk security and bug fix update
Summary
ALSA-2023:4178: Moderate: java-1.8.0-openjdk security and bug fix update. Affects java-1.8.0-openjdk versions < 1:1.8.0.382.b05-2.el9. Fixed in 1:1.8.0.382.b05-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. These packages are used for running Java applications and developing Java software. The vulnerability affects the AlmaLinux 9 ecosystem.
Vulnerability Detail
The vulnerability in java-1.8.0-openjdk is related to improper handling of slash characters in URI-to-path conversion (CVE-2023-22049) and an array indexing integer overflow issue (CVE-2023-22045). The improper handling of slash characters can lead to security vulnerabilities, potentially allowing attackers to manipulate paths and access unauthorized resources. The array indexing integer overflow issue can result in memory corruption and potential code execution. These vulnerabilities have a moderate severity level.
How To Fix
Minimum fixed version
1:1.8.0.382.b05-2.el9
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating the java-1.8.0-openjdk package.
Conclusion
The java-1.8.0-openjdk package in the AlmaLinux 9 ecosystem has been found to have moderate security vulnerabilities. It is recommended to update the package to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
java-1.8.0-openjdk is the OpenJDK 8 Java Runtime Environment and Java Software Development Kit. It is used for running Java applications and developing Java software.
The vulnerabilities can potentially allow attackers to manipulate paths and access unauthorized resources, as well as cause memory corruption and potential code execution.
To fix the vulnerability, update the java-1.8.0-openjdk package to version 1.8.0.382.b05-2.el9 or later.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by updating the java-1.8.0-openjdk package.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
