ALSA-2023:4159
- Source
- https://errata.almalinux.org/8/ALSA-2023-4159.html
- Import Source
- https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2023:4159.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ALSA-2023:4159
- Related
- Published
- 2023-07-20T00:00:00Z
- Modified
- 2023-07-21T18:32:49Z
- Summary
- Moderate: java-17-openjdk security and bug fix update
- Details
-
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
Security Fix(es):
- OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
- OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
- OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
- harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
- OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
- OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)
- OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221655)
- Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-8] (BZ#2222368)
- References
-
- https://access.redhat.com/errata/RHSA-2023:4159
- https://access.redhat.com/security/cve/CVE-2023-22006
- https://access.redhat.com/security/cve/CVE-2023-22036
- https://access.redhat.com/security/cve/CVE-2023-22041
- https://access.redhat.com/security/cve/CVE-2023-22044
- https://access.redhat.com/security/cve/CVE-2023-22045
- https://access.redhat.com/security/cve/CVE-2023-22049
- https://access.redhat.com/security/cve/CVE-2023-25193
- https://bugzilla.redhat.com/2167254
- https://bugzilla.redhat.com/2221626
- https://bugzilla.redhat.com/2221634
- https://bugzilla.redhat.com/2221642
- https://bugzilla.redhat.com/2221645
- https://bugzilla.redhat.com/2221647
- https://bugzilla.redhat.com/2223207
- https://errata.almalinux.org/8/ALSA-2023-4159.html
Affected packages
AlmaLinux:8 / java-17-openjdk
Package
- Name
- java-17-openjdk
AlmaLinux:8 / java-17-openjdk-demo
Package
- Name
- java-17-openjdk-demo
AlmaLinux:8 / java-17-openjdk-demo-fastdebug
Package
- Name
- java-17-openjdk-demo-fastdebug
AlmaLinux:8 / java-17-openjdk-demo-slowdebug
Package
- Name
- java-17-openjdk-demo-slowdebug
AlmaLinux:8 / java-17-openjdk-devel
Package
- Name
- java-17-openjdk-devel
AlmaLinux:8 / java-17-openjdk-devel-fastdebug
Package
- Name
- java-17-openjdk-devel-fastdebug
AlmaLinux:8 / java-17-openjdk-devel-slowdebug
Package
- Name
- java-17-openjdk-devel-slowdebug
AlmaLinux:8 / java-17-openjdk-fastdebug
Package
- Name
- java-17-openjdk-fastdebug
AlmaLinux:8 / java-17-openjdk-headless
Package
- Name
- java-17-openjdk-headless
AlmaLinux:8 / java-17-openjdk-headless-fastdebug
Package
- Name
- java-17-openjdk-headless-fastdebug
AlmaLinux:8 / java-17-openjdk-headless-slowdebug
Package
- Name
- java-17-openjdk-headless-slowdebug
AlmaLinux:8 / java-17-openjdk-javadoc
Package
- Name
- java-17-openjdk-javadoc
AlmaLinux:8 / java-17-openjdk-javadoc-zip
Package
- Name
- java-17-openjdk-javadoc-zip
AlmaLinux:8 / java-17-openjdk-jmods
Package
- Name
- java-17-openjdk-jmods
AlmaLinux:8 / java-17-openjdk-jmods-fastdebug
Package
- Name
- java-17-openjdk-jmods-fastdebug
AlmaLinux:8 / java-17-openjdk-jmods-slowdebug
Package
- Name
- java-17-openjdk-jmods-slowdebug
AlmaLinux:8 / java-17-openjdk-slowdebug
Package
- Name
- java-17-openjdk-slowdebug
AlmaLinux:8 / java-17-openjdk-src
Package
- Name
- java-17-openjdk-src
AlmaLinux:8 / java-17-openjdk-src-fastdebug
Package
- Name
- java-17-openjdk-src-fastdebug
AlmaLinux:8 / java-17-openjdk-src-slowdebug
Package
- Name
- java-17-openjdk-src-slowdebug
AlmaLinux:8 / java-17-openjdk-static-libs
Package
- Name
- java-17-openjdk-static-libs
AlmaLinux:8 / java-17-openjdk-static-libs-fastdebug
Package
- Name
- java-17-openjdk-static-libs-fastdebug