Important: java-11-openjdk security, bug fix, and enhancement update
Summary
ALSA-2022:5695: Important: java-11-openjdk security, bug fix, and enhancement update. Affects java-11-openjdk versions < 1:11.0.16.0.8-1.el9_0. Fixed in 1:11.0.16.0.8-1.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. This package is widely used for developing and running Java applications. It includes the necessary tools and libraries for executing Java programs. However, it has been found that the package is vulnerable to multiple security issues, which can potentially lead to unauthorized access, data breaches, and other malicious activities.
Vulnerability Detail
The vulnerability in the java-11-openjdk package includes:
-
Integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169): This vulnerability allows an attacker to manipulate integer values in a way that could lead to memory corruption or arbitrary code execution.
-
Class compilation issue (Hotspot, 8281859) (CVE-2022-21540): This vulnerability allows an attacker to exploit a flaw in the class compilation process, potentially leading to code execution or privilege escalation.
-
Improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541): This vulnerability allows an attacker to bypass security restrictions and execute arbitrary code through the MethodHandle.invokeBasic() method.
These vulnerabilities can be exploited by remote attackers to compromise the security of the Java Runtime Environment and the applications running on it.
How To Fix
Minimum fixed version
1:11.0.16.0.8-1.el9_0
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is highly recommended to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
The java-11-openjdk package is vulnerable to multiple security issues that can be exploited by remote attackers. To ensure the security of your system, it is crucial to update the package to the latest version (11.0.16.0.8) and restart any running Java applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for java-11-openjdk →
FAQ
These vulnerabilities can be exploited by remote attackers to execute arbitrary code, gain unauthorized access, or perform other malicious activities on systems running the vulnerable java-11-openjdk package.
Yes, all versions of the java-11-openjdk package prior to 11.0.16.0.8 are affected by these vulnerabilities. It is recommended to update to the latest version to ensure the security of your system.
Yes, these vulnerabilities can be exploited remotely without authentication, making them particularly dangerous. It is crucial to apply the security update as soon as possible.
There is no evidence of active exploitation of these vulnerabilities at the moment. However, it is important to apply the security update to prevent potential attacks in the future.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related details, on the CVE pages listed in the References section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
