Moderate: java-11-openjdk security update
Summary
ALSA-2024:1822: Moderate: java-11-openjdk security update. Affects java-11-openjdk versions < 1:11.0.23.0.9-3.el9. Fixed in 1:11.0.23.0.9-3.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the java-11-openjdk packages:
-
CVE-2024-21011: This vulnerability is caused by a long exception message that can lead to a crash. An attacker could exploit this vulnerability to cause a denial of service.
-
CVE-2024-21068: This vulnerability is an integer overflow in the C1 compiler address generation. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2024-21085: This vulnerability is related to excessive memory allocation in the Pack200 compression algorithm. An attacker could exploit this vulnerability to cause a denial of service.
-
CVE-2024-21094: This vulnerability is a compilation failure in the C2 compiler, which can lead to a crash. An attacker could exploit this vulnerability to cause a denial of service.
-
CVE-2024-21012: This vulnerability is an improper reverse DNS lookup in the HTTP/2 client. An attacker could exploit this vulnerability to perform a man-in-the-middle attack or obtain sensitive information.
These vulnerabilities have a moderate impact and could potentially be exploited by remote attackers.
How To Fix
Minimum fixed version
1:11.0.23.0.9-3.el9
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities at this time.
Conclusion
In conclusion, the java-11-openjdk packages are affected by multiple vulnerabilities that could be exploited by remote attackers. It is recommended to update the packages to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for java-11-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java software.
These vulnerabilities have a moderate impact and could potentially be exploited by remote attackers. They could lead to a denial of service, arbitrary code execution, or information disclosure.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and it will analyze the dependencies for any known vulnerabilities.
There are no known workarounds for these vulnerabilities at this time. It is recommended to update the java-11-openjdk packages to the latest version.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and acknowledgments, on the respective CVE pages: CVE-2024-21011, CVE-2024-21012, CVE-2024-21068, CVE-2024-21085, CVE-2024-21094.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
