Important: java-21-openjdk security update
Summary
RLSA-2024:4573: Important: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.4.0.7-1.el8. Fixed in 1:21.0.4.0.7-1.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. These packages are used for running Java applications and developing Java-based software. The vulnerability affects the java-21-openjdk package in Rocky Linux 8 and Rocky Linux 9.
Vulnerability Detail
The vulnerability in the java-21-openjdk package is categorized as important. It includes the following security issues:
-
RangeCheckElimination array index overflow (CVE-2024-21147): This vulnerability can lead to an array index overflow, potentially resulting in arbitrary code execution.
-
Potential UTF8 size overflow (CVE-2024-21131): This vulnerability can cause a size overflow in UTF8 encoding, leading to memory corruption and potential code execution.
-
Excessive symbol length can lead to infinite loop (CVE-2024-21138): This vulnerability allows an attacker to create a symbol with an excessive length, causing an infinite loop and denial of service.
-
Range Check Elimination (RCE) pre-loop limit overflow (CVE-2024-21140): This vulnerability can be exploited to overflow the pre-loop limit in Range Check Elimination, potentially leading to arbitrary code execution.
-
Out-of-bounds access in 2D image handling (CVE-2024-21145): This vulnerability allows an attacker to access out-of-bounds memory in 2D image handling, potentially resulting in information disclosure or code execution.
How To Fix
Minimum fixed version
1:21.0.4.0.7-1.el8
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The java-21-openjdk package in Rocky Linux is affected by multiple important vulnerabilities that can lead to various security risks. It is crucial to update the package to the fixed versions to mitigate these vulnerabilities and ensure the security of Java applications and software developed using OpenJDK 21.
See every vulnerability recorded for java-21-openjdk →
FAQ
These vulnerabilities can lead to arbitrary code execution, memory corruption, denial of service, information disclosure, and potential security breaches.
At the time of this report, there are no known public exploits for these vulnerabilities. However, it is important to apply the security update as soon as possible to mitigate any potential risks.
Yes, all versions of the java-21-openjdk package prior to 1:21.0.4.0.7-1.el8 for Rocky Linux 8 and 1:21.0.4.0.7-1.el9 for Rocky Linux 9 are affected by these vulnerabilities.
Yes, these vulnerabilities can be exploited remotely if the affected system is running a vulnerable version of the java-21-openjdk package and is accessible over the network.
Currently, there are no known workarounds for these vulnerabilities. It is recommended to update the java-21-openjdk package to the fixed versions mentioned earlier.
References
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
