OpenJDK 11 Java Runtime Environment and SDK - Multiple Security Vulnerabilities
Summary
ALSA-2024:4567: Important: java-11-openjdk security update. Affects java-11-openjdk versions < 1:11.0.24.0.8-3.el8. Fixed in 1:11.0.24.0.8-3.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OpenJDK 11 Java Runtime Environment and Software Development Kit (SDK) provide a platform for running and developing Java applications. It is widely used in various software systems and frameworks. However, several security vulnerabilities have been identified in the OpenJDK 11, which could potentially be exploited by attackers to compromise the integrity, confidentiality, and availability of affected systems.
Vulnerability Detail
The identified vulnerabilities in the OpenJDK 11 include:
-
RangeCheckElimination array index overflow (CVE-2024-21147): This vulnerability could allow an attacker to overflow array indexes, leading to potential memory corruption and arbitrary code execution.
-
Potential UTF8 size overflow (CVE-2024-21131): This vulnerability could result in a size overflow in UTF8 encoding, potentially leading to memory corruption and code execution.
-
Excessive symbol length can lead to infinite loop (CVE-2024-21138): This vulnerability could allow an attacker to create symbols with excessive length, causing an infinite loop and denial of service.
-
Range Check Elimination (RCE) pre-loop limit overflow (CVE-2024-21140): This vulnerability could lead to an overflow in the pre-loop limit during Range Check Elimination, potentially resulting in memory corruption and code execution.
-
Pack200 increase loading time due to improper header validation (CVE-2024-21144): This vulnerability could allow an attacker to increase loading time by exploiting improper header validation in Pack200.
-
Out-of-bounds access in 2D image handling (CVE-2024-21145): This vulnerability could lead to out-of-bounds access in 2D image handling, potentially resulting in memory corruption and code execution.
These vulnerabilities pose a significant risk to systems running the affected versions of OpenJDK 11 and could be exploited by remote attackers to execute arbitrary code, cause denial of service, or gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1:11.0.24.0.8-3.el8
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security updates as soon as they are available.
Conclusion
The identified security vulnerabilities in the OpenJDK 11 Java Runtime Environment and Software Development Kit pose a significant risk to affected systems. It is crucial to update the affected packages to the latest version to mitigate the risk of exploitation. Failure to apply the necessary security updates could result in unauthorized access, arbitrary code execution, and denial of service attacks.
See every vulnerability recorded for java-11-openjdk →
FAQ
OpenJDK 11 is an open-source implementation of the Java Development Kit (JDK) and the Java Runtime Environment (JRE). It provides a platform for running and developing Java applications.
These vulnerabilities can be exploited by remote attackers to execute arbitrary code, cause denial of service, or gain unauthorized access to sensitive information.
Yes, all versions of OpenJDK 11 prior to 1:11.0.24.0.8-2.el9 are affected by these vulnerabilities.
Yes, the recommended fix is to update the affected OpenJDK 11 packages to version 1:11.0.24.0.8-2.el9 or later.
There are no known workarounds for these vulnerabilities. It is crucial to apply the security updates as soon as they are available.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
