SUSE-SU-2023:2242-1
- Source
- https://www.suse.com/support/update/announcement/2023/suse-su-20232242-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2242-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2023:2242-1
- Related
- Published
- 2023-05-18T07:53:30Z
- Modified
- 2023-05-18T07:53:30Z
- Summary
- Security update for java-1_8_0-openjdk
- Details
-
This update for java-180-openjdk fixes the following issues:
- Updated to version jdk8u372 (icedtea-3.27.0):
- CVE-2023-21930: Fixed an issue in the JSSE component that could allow an attacker to access critical data without authorization (bsc#1210628).
- CVE-2023-21937: Fixed an issue in the Networking component that could allow an attacker to update, insert or delete some data without authorization (bsc#1210631).
- CVE-2023-21938: Fixed an issue in the Libraries component that could allow an attacker to update, insert or delete some data without authorization (bsc#1210632).
- CVE-2023-21939: Fixed an issue in the Swing component that could allow an attacker to update, insert or delete some data without authorization (bsc#1210634).
- CVE-2023-21954: Fixed an issue in the Hotspot component that could allow an attacker to access critical data without authorization (bsc#1210635).
- CVE-2023-21967: Fixed an issue in the JSSE component that could allow an attacker to cause a hang or frequently repeatable crash without authorization (bsc#1210636).
- CVE-2023-21968: Fixed an issue in the Libraries component that could allow an attacker to update, insert or delete some data without authorization (bsc#1210637).
- Updated to version jdk8u372 (icedtea-3.27.0):
- References
-
- https://www.suse.com/support/update/announcement/2023/suse-su-20232242-1/
- https://bugzilla.suse.com/1210628
- https://bugzilla.suse.com/1210631
- https://bugzilla.suse.com/1210632
- https://bugzilla.suse.com/1210634
- https://bugzilla.suse.com/1210635
- https://bugzilla.suse.com/1210636
- https://bugzilla.suse.com/1210637
- https://www.suse.com/security/cve/CVE-2023-21930
- https://www.suse.com/security/cve/CVE-2023-21937
- https://www.suse.com/security/cve/CVE-2023-21938
- https://www.suse.com/security/cve/CVE-2023-21939
- https://www.suse.com/security/cve/CVE-2023-21954
- https://www.suse.com/security/cve/CVE-2023-21967
- https://www.suse.com/security/cve/CVE-2023-21968
Affected packages
SUSE:Linux Enterprise Module for Legacy 15 SP4 / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP4
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS
SUSE:Linux Enterprise Server 15 SP1-LTSS / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS
SUSE:Linux Enterprise Server 15 SP2-LTSS / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS
SUSE:Linux Enterprise Server 15 SP3-LTSS / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS
SUSE:Linux Enterprise Server for SAP Applications 15 SP1 / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1
SUSE:Linux Enterprise Server for SAP Applications 15 SP2 / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3
SUSE:Enterprise Storage 7 / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Enterprise%20Storage%207
SUSE:Enterprise Storage 7.1 / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Enterprise%20Storage%207.1
openSUSE:Leap 15.4 / java-1_8_0-openjdk
Package
- Name
- java-1_8_0-openjdk
- Purl
- pkg:rpm/opensuse/java-1_8_0-openjdk&distro=openSUSE%20Leap%2015.4
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.8.0.372-150000.3.79.1
Ecosystem specific
{
"binaries": [
{
"java-1_8_0-openjdk": "1.8.0.372-150000.3.79.1",
"java-1_8_0-openjdk-devel": "1.8.0.372-150000.3.79.1",
"java-1_8_0-openjdk-src": "1.8.0.372-150000.3.79.1",
"java-1_8_0-openjdk-demo": "1.8.0.372-150000.3.79.1",
"java-1_8_0-openjdk-javadoc": "1.8.0.372-150000.3.79.1",
"java-1_8_0-openjdk-accessibility": "1.8.0.372-150000.3.79.1",
"java-1_8_0-openjdk-headless": "1.8.0.372-150000.3.79.1"
}
]
}