Moderate: java-11-openjdk security and bug fix update
Summary
ALSA-2022:7013: Moderate: java-11-openjdk security and bug fix update. Affects java-11-openjdk versions < 1:11.0.17.0.8-2.el9_0. Fixed in 1:11.0.17.0.8-2.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used for building and running Java applications on various platforms.
Vulnerability Detail
This vulnerability affects the java-11-openjdk package. It includes several security fixes:
-
CVE-2022-21618: This vulnerability is caused by improper MultiByte conversion, which can lead to a buffer overflow in the JGSS component of OpenJDK. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2022-21626: This vulnerability is caused by excessive memory allocation in X.509 certificate parsing. An attacker could exploit this vulnerability to cause a denial of service by sending a specially crafted certificate.
-
CVE-2022-21628: This vulnerability affects the Lightweight HTTP Server component of OpenJDK. It allows an attacker to establish multiple connections to the server without any connection count limit, potentially leading to resource exhaustion.
-
CVE-2022-21619: This vulnerability is caused by improper handling of long NTLM client hostnames. An attacker could exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.
-
CVE-2022-21624: This vulnerability is caused by insufficient randomization of JNDI DNS port numbers. An attacker could exploit this vulnerability to conduct DNS cache poisoning attacks.
-
CVE-2022-39399: This vulnerability is caused by missing SNI (Server Name Indication) caching in HTTP/2. An attacker could exploit this vulnerability to conduct cache-based side-channel attacks.
These vulnerabilities have a moderate impact and could potentially allow an attacker to execute arbitrary code, cause a denial of service, or conduct cache-based side-channel attacks.
How To Fix
Minimum fixed version
1:11.0.17.0.8-2.el9_0
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the java-11-openjdk package is affected by several moderate vulnerabilities. It is crucial to update the package to the latest version to mitigate the risks associated with these vulnerabilities. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-11-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running and developing Java applications, respectively.
These vulnerabilities have a moderate impact and could potentially allow an attacker to execute arbitrary code, cause a denial of service, or conduct cache-based side-channel attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including the ones mentioned in this advisory.
At the moment, there are no specific workarounds mentioned for these vulnerabilities. It is recommended to update the java-11-openjdk package to the latest version to mitigate the risks.
You can find more information about these vulnerabilities, including their CVE identifiers, on the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
