Important: java-17-openjdk security update
Summary
ALSA-2024:4568: Important: java-17-openjdk security update. Affects java-17-openjdk versions < 1:17.0.12.0.7-2.el9. Fixed in 1:17.0.12.0.7-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. These packages are used for running Java applications and developing Java programs. The OpenJDK 17 is a widely used open-source implementation of the Java SE Platform.
Vulnerability Detail
The vulnerability (CVE-2024-21147) in the java-17-openjdk package is related to a RangeCheckElimination array index overflow. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. The issue arises due to improper bounds checking in the array index, allowing an attacker to access memory outside the bounds of the array. This can lead to memory corruption and potentially allow the attacker to gain control over the affected system.
How To Fix
Minimum fixed version
1:17.0.12.0.7-2.el9
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security update provided by the package maintainers.
Conclusion
The java-17-openjdk package is affected by a critical vulnerability that can allow an attacker to execute arbitrary code or cause a denial of service. It is crucial to update the package to the latest version to mitigate the risk of exploitation. No known workarounds are available, and users are advised to apply the security update as soon as possible. For more information and assistance, refer to the provided CVE page(s) and consider using Vulert's playground to check if your system is affected.
See every vulnerability recorded for java-17-openjdk →
FAQ
This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service. It poses a significant risk to systems running the affected version of the java-17-openjdk package.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the security update as soon as possible to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can send a specially crafted request to a vulnerable system, triggering the array index overflow and potentially gaining control over the affected system.
For more details about this vulnerability, including the impact, CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
