Moderate: java-21-openjdk security and bug fix update
Summary
ALSA-2023:6738: Moderate: java-21-openjdk security and bug fix update. Affects java-21-openjdk versions < 1:21.0.1.0.12-2.el9.alma.1. Fixed in 1:21.0.1.0.12-2.el9.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
This update addresses two security vulnerabilities in the java-21-openjdk package:
-
Memory Corruption Issue on x86_64 with AVX-512 (CVE-2023-22025): This vulnerability could allow an attacker to corrupt memory on systems using x86_64 architecture with AVX-512 instructions. This could potentially lead to arbitrary code execution or system crashes.
-
Certificate Path Validation Issue during Client Authentication (CVE-2023-22081): This vulnerability could allow an attacker to bypass certificate path validation during client authentication. This could lead to unauthorized access or man-in-the-middle attacks.
Both vulnerabilities have been fixed in the 21.0.1 release of OpenJDK.
How To Fix
Minimum fixed version
1:21.0.1.0.12-2.el9.alma.1
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The java-21-openjdk package has been updated to address two security vulnerabilities. It is recommended to update the package to version 21.0.1 or later to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-21-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java software.
The memory corruption vulnerability could allow an attacker to corrupt memory on systems using x86_64 architecture with AVX-512 instructions. This could potentially lead to arbitrary code execution or system crashes.
The certificate path validation vulnerability could allow an attacker to bypass certificate path validation during client authentication. This could lead to unauthorized access or man-in-the-middle attacks.
To update the java-21-openjdk package, you can use the package manager update command specific to your operating system. For example, on AlmaLinux 9, you can use the following command:
sudo dnf update java-21-openjdk
No specific workarounds have been mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
