Moderate: java-17-openjdk security and bug fix update
Summary
ALSA-2023:4177: Moderate: java-17-openjdk security and bug fix update. Affects java-17-openjdk versions < 1:17.0.8.0.7-2.el9. Fixed in 1:17.0.8.0.7-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. These packages are used for running Java applications and developing Java programs. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and systems.
Vulnerability Detail
This vulnerability affects the java-17-openjdk package and is categorized as moderate. It includes several security fixes and bug fixes. The security fixes address various vulnerabilities, including ZIP file parsing infinite loop, weakness in AES implementation, improper handling of slash characters in URI-to-path conversion, O(n^2) growth via consecutive marks in harfbuzz, HTTP client insufficient file name validation, modulo operator array indexing issue, and array indexing integer overflow issue. These vulnerabilities could potentially lead to security breaches, data leaks, or denial of service attacks.
How To Fix
Minimum fixed version
1:17.0.8.0.7-2.el9
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The java-17-openjdk package has been found to have several security vulnerabilities and bugs. It is crucial to update the package to the latest version to ensure the security and stability of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for java-17-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java programs.
These vulnerabilities could potentially lead to security breaches, data leaks, or denial of service attacks. Attackers may exploit these vulnerabilities to gain unauthorized access, execute arbitrary code, or manipulate sensitive data.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
No specific workarounds are mentioned for these vulnerabilities. It is recommended to update the java-17-openjdk package to the latest version to mitigate the risks.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related CVEs, in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
