Important: java-17-openjdk security, bug fix, and enhancement update
Summary
ALSA-2022:5736: Important: java-17-openjdk security, bug fix, and enhancement update. Affects java-17-openjdk versions < 1:17.0.4.0.8-2.el9_0. Fixed in 1:17.0.4.0.8-2.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. This package is used for running Java applications and developing Java programs. It includes the Java Virtual Machine (JVM), Java class libraries, and development tools. The vulnerability affects the java-17-openjdk package in AlmaLinux 9.
Vulnerability Detail
The vulnerability in the java-17-openjdk package is classified as important. It includes multiple security fixes, bug fixes, and enhancements. The security fixes address the following issues:
-
Integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169): This vulnerability could allow an attacker to cause a denial of service or execute arbitrary code.
-
Class compilation issue (Hotspot, 8281859) (CVE-2022-21540): This vulnerability could allow an attacker to execute arbitrary code.
-
Improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541): This vulnerability could allow an attacker to execute arbitrary code.
-
Random exponentials issue (Libraries, 8283875) (CVE-2022-21549): This vulnerability could allow an attacker to execute arbitrary code.
For more details about the security issues, including the impact, CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.
How To Fix
Minimum fixed version
1:17.0.4.0.8-2.el9_0
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
The java-17-openjdk package in AlmaLinux 9 is affected by an important vulnerability that includes security fixes, bug fixes, and enhancements. To mitigate the vulnerability, it is recommended to update the package to the latest version. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-17-openjdk →
FAQ
The impact of this vulnerability varies depending on the specific issue. It could range from denial of service to arbitrary code execution.
There is no information provided about known exploits for this vulnerability.
The recommended mitigation is to update the java-17-openjdk package to the latest version.
The information provided does not specify whether this vulnerability can be exploited remotely or requires local access.
For more information about the vulnerability, including the CVE pages and related references, please refer to the provided links in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
