Moderate: java-17-openjdk security and bug fix update
Summary
ALSA-2023:0194: Moderate: java-17-openjdk security and bug fix update. Affects java-17-openjdk versions < 1:17.0.6.0.10-3.el9_1. Fixed in 1:17.0.6.0.10-3.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. These packages are used for running Java applications and developing Java software. The OpenJDK 17 is a popular open-source implementation of the Java SE Platform.
Vulnerability Detail
The vulnerability in the java-17-openjdk package is classified as moderate. It includes two security fixes:
-
Handshake DoS attack against DTLS connections (CVE-2023-21835): This vulnerability allows an attacker to launch a denial-of-service attack against DTLS connections by manipulating the handshake process.
-
Soundbank URL remote loading (CVE-2023-21843): This vulnerability allows an attacker to load soundbank files from remote locations, potentially leading to the execution of arbitrary code.
These vulnerabilities can have various impacts, including service disruption, unauthorized code execution, and potential data breaches.
How To Fix
Minimum fixed version
1:17.0.6.0.10-3.el9_1
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risks.
Conclusion
The java-17-openjdk package has been found to have two moderate security vulnerabilities. To mitigate the risks, it is recommended to update the package to the fixed version. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-17-openjdk →
FAQ
Java-17-openjdk is an open-source implementation of the Java SE Platform, providing the Java Runtime Environment and Software Development Kit.
These vulnerabilities can lead to service disruption, unauthorized code execution, and potential data breaches.
To fix the vulnerabilities, update the java-17-openjdk package to the fixed version 1:17.0.6.0.10-3.el9_1.
No specific workarounds are mentioned for these vulnerabilities. It is recommended to apply the security update.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
