Important: java-11-openjdk security update
Summary
ALSA-2023:1880: Important: java-11-openjdk security update. Affects java-11-openjdk versions < 1:11.0.19.0.7-1.el9_1. Fixed in 1:11.0.19.0.7-1.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. These packages are used for running Java applications and developing Java programs. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the java-11-openjdk packages:
-
CVE-2023-21930: This vulnerability relates to improper connection handling during the TLS handshake. It could allow an attacker to perform a man-in-the-middle attack and intercept sensitive information exchanged over a TLS connection.
-
CVE-2023-21939: This vulnerability is related to a parsing issue in Swing HTML. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2023-21954: This vulnerability is caused by incorrect enqueue of references in the garbage collector. It could lead to memory corruption and potentially allow an attacker to execute arbitrary code.
-
CVE-2023-21967: This vulnerability is related to a certificate validation issue in TLS session negotiation. It could allow an attacker to bypass certificate validation and establish a malicious connection.
-
CVE-2023-21937: This vulnerability is caused by missing string checks for NULL characters. An attacker could exploit this vulnerability to bypass security restrictions and execute arbitrary code.
-
CVE-2023-21938: This vulnerability is related to incorrect handling of NULL characters in ProcessBuilder. It could allow an attacker to execute arbitrary commands.
-
CVE-2023-21968: This vulnerability is caused by a missing check for slash characters in URI-to-path conversion. An attacker could exploit this vulnerability to perform directory traversal attacks and access sensitive files.
These vulnerabilities have varying levels of severity and potential impact, ranging from information disclosure to remote code execution.
How To Fix
Minimum fixed version
1:11.0.19.0.7-1.el9_1
This is the first release that contains the fix.
sudo dnf update java-11-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
This security update addresses multiple vulnerabilities in the java-11-openjdk packages. It is recommended to update the packages to the latest version to mitigate the risk of exploitation. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for java-11-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java programs.
The impact of these vulnerabilities can vary depending on the specific vulnerability. They range from information disclosure to remote code execution, which could potentially allow an attacker to intercept sensitive information, execute arbitrary code, or bypass security restrictions.
To update the java-11-openjdk packages, you can use the package manager specific to your operating system. For example, on AlmaLinux 9, you can use the 'dnf' package manager and run the command 'sudo dnf update java-11-openjdk'.
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related CVE pages, in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for java-11-openjdk.
