SUSE-SU-2024:3963-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2024/suse-su-20243963-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:3963-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2024:3963-1

Related

Published

2024-11-09T16:39:18Z

Modified

2024-11-09T16:39:18Z

Summary

Security update for java-17-openjdk

Details

This update for java-17-openjdk fixes the following issues:

Update to upstream tag jdk-17.0.13+11 (October 2024 CPU)
- Security fixes
  - JDK-8307383: Enhance DTLS connections
  - JDK-8290367, JDK-8332643: Update default value and extend the scope of com.sun.jndi.ldap.object.trustSerialData system property
  - JDK-8328286, CVE-2024-21208, bsc#1231702: Enhance HTTP client
  - JDK-8328544, CVE-2024-21210, bsc#1231711: Improve handling of vectorization
  - JDK-8328726: Better Kerberos support
  - JDK-8331446, CVE-2024-21217, bsc#1231716: Improve deserialization support
  - JDK-8332644, CVE-2024-21235, bsc#1231719: Improve graph optimizations
  - JDK-8335713: Enhance vectorization analysis
- Other changes
  - JDK-7022325: TESTBUG: test/java/util/zip/ZipFile/ /ReadLongZipFileName.java leaks files if it fails
  - JDK-8170817: G1: Returning MinTLABSize from unsafemaxtlaballoc causes TLAB flapping
  - JDK-8183227: read/write APIs in class os shall return ssizet
  - JDK-8273541: Cleaner Thread creates with normal priority instead of MAXPRIORITY - 2
  - JDK-8275851: Deproblemlist open/test/jdk/javax/swing/ /JComponent/6683775/bug6683775.java
  - JDK-8276660: Scalability bottleneck in java.security.Provider.getService()
  - JDK-8277042: add test for 8276036 to compiler/codecache
  - JDK-8279068: IGV: Update to work with JDK 16 and 17
  - JDK-8279164: Disable TLSECDH* cipher suites
  - JDK-8279222: Incorrect legacyMap.get in java.security.Provider after JDK-8276660
  - JDK-8279337: The MToolkit is still referenced in a few places
  - JDK-8279641: Create manual JTReg tests for Swing accessibility
  - JDK-8279878: java/awt/font/JNICheck/JNICheck.sh test fails on Ubuntu 21.10
  - JDK-8280034: ProblemList jdk/jfr/api/consumer/recordingstream/ /TestOnEvent.java on linux-x64
  - JDK-8280392: java/awt/Focus/NonFocusableWindowTest/ /NonfocusableOwnerTest.java failed with 'RuntimeException: Test failed.'
  - JDK-8280970: Cleanup dead code in java.security.Provider
  - JDK-8280982: [Wayland] [XWayland] java.awt.Robot taking screenshots
  - JDK-8280988: [XWayland] Click on title to request focus test failures
  - JDK-8280990: [XWayland] XTest emulated mouse click does not bring window to front
  - JDK-8280993: [XWayland] Popup is not closed on click outside of area controlled by XWayland
  - JDK-8280994: [XWayland] Drag and Drop does not work in java -> wayland app direction
  - JDK-8281944: JavaDoc throws java.lang.IllegalStateException: ERRONEOUS
  - JDK-8282354: Remove dependancy of TestHttpServer, HttpTransaction, HttpCallback from open/test/jdk/ tests
  - JDK-8282526: Default icon is not painted properly
  - JDK-8283728: jdk.hotspot.agent: Wrong location for RISCV64ThreadContext.java
  - JDK-8284316: Support accessibility ManualTestFrame.java for non SwingSet tests
  - JDK-8284585: PushPromiseContinuation test fails intermittently in timeout
  - JDK-8285497: Add system property for Java SE specification maintenance version
  - JDK-8288568: Reduce runtime of java.security microbenchmarks
  - JDK-8289182: NMT: MemTracker::baseline should return void
  - JDK-8290966: G1: Record number of PLAB filled and number of direct allocations
  - JDK-8291760: PipelineLeaksFD.java still fails: More or fewer pipes than expected
  - JDK-8292044: HttpClient doesn't handle 102 or 103 properly
  - JDK-8292739: Invalid legacy entries may be returned by Provider.getServices() call
  - JDK-8292948: JEditorPane ignores font-size styles in external linked css-file
  - JDK-8293862: javax/swing/JFileChooser/8046391/bug8046391.java failed with 'Cannot invoke 'java.awt.Image.getWidth(java.awt.image.ImageObserver)' because 'retVal' is null'
  - JDK-8293872: Make runtime/Thread/ThreadCountLimit.java more robust
  - JDK-8294148: Support JSplitPane for instructions and test UI
  - JDK-8294691: dynamicArchive/RelativePath.java is running other test case
  - JDK-8294994: Update Jarsigner and Keytool i18n tests to validate i18n compliance
  - JDK-8295111: dpkg appears to have problems resolving symbolically linked native libraries
  - JDK-8296410: HttpClient throws java.io.IOException: no statuscode in response for HTTP2
  - JDK-8296812: sprintf is deprecated in Xcode 14
  - JDK-8297878: KEM: Implementation
  - JDK-8298381: Improve handling of session tickets for multiple SSLContexts
  - JDK-8298596: vmTestbase/nsk/sysdict/vm/stress/chain/chain008/ /chain008.java fails with 'NoClassDefFoundError: Could not initialize class java.util.concurrent.ThreadLocalRandom'
  - JDK-8298809: Clean up vm/compiler/InterfaceCalls JMH
  - JDK-8299058: AssertionError in sun.net.httpserver.ServerImpl when connection is idle
  - JDK-8299254: Support dealing with standard assert macro
  - JDK-8299378: sprintf is deprecated in Xcode 14
  - JDK-8299395: Remove metaprogramming/removeCV.hpp
  - JDK-8299396: Remove metaprogramming/removeExtent.hpp
  - JDK-8299397: Remove metaprogramming/isFloatingPoint.hpp
  - JDK-8299398: Remove metaprogramming/isConst.hpp
  - JDK-8299399: Remove metaprogramming/isArray.hpp
  - JDK-8299402: Remove metaprogramming/isVolatile.hpp
  - JDK-8299479: Remove metaprogramming/decay.hpp
  - JDK-8299481: Remove metaprogramming/removePointer.hpp
  - JDK-8299482: Remove metaprogramming/isIntegral.hpp
  - JDK-8299487: Test java/net/httpclient/whitebox/ /SSLTubeTestDriver.java timed out
  - JDK-8299635: Hotspot update for deprecated sprintf in Xcode 14
  - JDK-8299779: Test tools/jpackage/share/jdk/jpackage/tests/ /MainClassTest.java timed out
  - JDK-8299813: java/nio/channels/DatagramChannel/Disconnect.java fails with jtreg test timeout due to lost datagram
  - JDK-8299971: Remove metaprogramming/conditional.hpp
  - JDK-8299972: Remove metaprogramming/removeReference.hpp
  - JDK-8300169: Build failure with clang-15
  - JDK-8300260: Remove metaprogramming/isSame.hpp
  - JDK-8300264: Remove metaprogramming/isPointer.hpp
  - JDK-8300265: Remove metaprogramming/isSigned.hpp
  - JDK-8300806: Update googletest to v1.13.0
  - JDK-8300910: Remove metaprogramming/integralConstant.hpp
  - JDK-8301132: Test update for deprecated sprintf in Xcode 14
  - JDK-8301200: Don't scale timeout stress with timeout factor
  - JDK-8301274: update for deprecated sprintf for security components
  - JDK-8301279: update for deprecated sprintf for management components
  - JDK-8301686: TLS 1.3 handshake fails if servername doesn't match resuming session
  - JDK-8305959: x86: Improve itablestub
  - JDK-8306583: Add JVM crash check in CDSTestUtils.executeAndLog
  - JDK-8306929: Avoid CleanClassLoaderDataMetaspaces safepoints when previous versions are shared
  - JDK-8306946: jdk/test/lib/process/ /ProcessToolsStartProcessTest.java fails with 'wrong number of lines in OutputAnalyzer output'
  - JDK-8307091: A few client tests intermittently throw ConcurrentModificationException
  - JDK-8307193: Several Swing jtreg tests use class.forName on L&F classes
  - JDK-8307352: AARCH64: Improve itablestub
  - JDK-8318474: Fix memory reporter for threadcount
  - JDK-8318479: [jmh] the test security.CacheBench failed for multiple threads run
  - JDK-8318605: Enable parallelism in vmTestbase/nsk/stress/stack tests
  - JDK-8318696: Do not use LFS64 symbols on Linux
  - JDK-8318986: Improve GenericWaitBarrier performance
  - JDK-8319103: Popups that request focus are not shown on Linux with Wayland
  - JDK-8319197: Exclude hb-subset and hb-style from compilation
  - JDK-8319406: x86: Shorter movptr(reg, imm) for 32-bit immediates
  - JDK-8319713: Parallel: Remove PSAdaptiveSizePolicy::shouldfullGC
  - JDK-8320079: The ArabicBox.java test has no control buttons
  - JDK-8320379: C2: Sort spilling/unspilling sequence for better ld/st merging into ldp/stp on AArch64
  - JDK-8320602: Lock contention in SchemaDVFactory.getInstance()
  - JDK-8320608: Many jtreg printing tests are missing the @printer keyword
  - JDK-8320655: awt screencast robot spin and sync issues with native libpipewire api
  - JDK-8320692: Null icon returned for .exe without custom icon
  - JDK-8320945: problemlist tests failing on latest Windows 11 update
  - JDK-8321025: Enable Neoverse N1 optimizations for Neoverse V2
  - JDK-8321176: [Screencast] make a second attempt on screencast failure
  - JDK-8321220: JFR: RecordedClass reports incorrect modifiers
  - JDK-8322008: Exclude some CDS tests from running with -Xshare:off
  - JDK-8322330: JavadocHelperTest.java OOMEs with Parallel GC and ZGC
  - JDK-8322726: C2: Unloaded signature class kills argument value
  - JDK-8322971: KEM.getInstance() should check if a 3rd-party security provider is signed
  - JDK-8323122: AArch64: Increase itable stub size estimate
  - JDK-8323584: AArch64: Unnecessary ResourceMark in NativeCall::setdestinationmtsafe
  - JDK-8324753: [AIX] adjust osposix after JDK-8318696
  - JDK-8324755: Enable parallelism in vmTestbase/gc/gctests/LargeObjects tests
  - JDK-8324933: ConcurrentHashTable::statisticscalculate synchronization is expensive
  - JDK-8329103: assert(!thread->inasgct()) failed during multi-mode profiling
  - JDK-8329109: Threads::printon() tries to print CPU time for terminated GC threads
  - JDK-8329663: hserr file event log entry for thread adding/removing should print current thread
  - JDK-8329667: [macos] Issue with JTree related fix for JDK-8317771
  - JDK-8329995: Restricted access to /proc can cause JFR initialization to crash
  - JDK-8330063: Upgrade jQuery to 3.7.1
  - JDK-8330524: Linux ppc64le compile warning with clang in oslinuxppc.cpp
  - JDK-8330611: AES-CTR vector intrinsic may read out of bounds (x8664, AVX-512)
  - JDK-8330615: avoid signed integer overflows in ziputil.c readCen / hashN
  - JDK-8331011: [XWayland] TokenStorage fails under Security Manager
  - JDK-8331063: Some HttpClient tests don't report leaks
  - JDK-8331077: nroff man page update for jar tool
  - JDK-8331164: createJMHBundle.sh download jars fail when url needed to be redirected
  - JDK-8331265: Bump update version for OpenJDK: jdk-17.0.13
  - JDK-8331331: :tier1 target explanation in doc/testing.md is incorrect
  - JDK-8331466: Problemlist serviceability/dcmd/gc/ /RunFinalizationTest.java on generic-all
  - JDK-8331605: jdk/test/lib/TestMutuallyExclusivePlatformPredicates.java test failure
  - JDK-8331746: Create a test to verify that the cmm id is not ignored
  - JDK-8331798: Remove unused arg of checkErgonomics() in TestMaxHeapSizeTools.java
  - JDK-8331885: C2: meet between unloaded and speculative types is not symmetric
  - JDK-8332008: Enable issuestitle check
  - JDK-8332113: Update nsk.share.Log to be always verbose
  - JDK-8332174: Remove 2 (unpaired) RLO Unicode characters in ffAdlm.xml
  - JDK-8332898: failurehandler: log directory of commands
  - JDK-8332936: Test vmTestbase/metaspace/gc/watermark7080/ /TestDescription.java fails with no GC's recorded
  - JDK-8333270: HandlersOnComplexResetUpdate and HandlersOnComplexUpdate tests fail with 'Unexpected reference' if timeoutFactor is less than 1/3
  - JDK-8333353: Delete extra empty line in CodeBlob.java
  - JDK-8333398: Uncomment the commented test in test/jdk/java/ /util/jar/JarFile/mrjar/MultiReleaseJarAPI.java
  - JDK-8333477: Delete extra empty spaces in Makefiles
  - JDK-8333698: [17u] TestJstatdRmiPort fails after JDK-8333667
  - JDK-8333716: Shenandoah: Check for disarmed method before taking the nmethod lock
  - JDK-8333724: Problem list security/infra/java/security/cert/ /CertPathValidator/certification/CAInterop.java #teliasonerarootcav1
  - JDK-8333804: java/net/httpclient/ForbiddenHeadTest.java threw an exception with 0 failures
  - JDK-8334166: Enable binary check
  - JDK-8334297: (so) java/nio/channels/SocketChannel/OpenLeak.java should not depend on SecurityManager
  - JDK-8334332: TestIOException.java fails if run by root
  - JDK-8334333: MissingResourceCauseTestRun.java fails if run by root
  - JDK-8334335: [TESTBUG] Backport of 8279164 to 11u & 17u includes elements of JDK-8163327
  - JDK-8334339: Test java/nio/file/attribute/ /BasicFileAttributeView/CreationTime.java fails on alinux3
  - JDK-8334418: Update IANA Language Subtag Registry to Version 2024-06-14
  - JDK-8334482: Shenandoah: Deadlock when safepoint is pending during nmethods iteration
  - JDK-8334600: TEST java/net/MulticastSocket/IPMulticastIF.java fails on linux-aarch64
  - JDK-8334653: ISO 4217 Amendment 177 Update
  - JDK-8334769: Shenandoah: Move CodeCachelock close to its use in ShenandoahConcurrentNMethodIterator
  - JDK-8341673: [17u] Remove designator DEFAULTPROMOTEDVERSIONPRE=ea for release 17.0.13

References

Affected packages

SUSE:Linux Enterprise Module for Basesystem 15 SP5 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Linux Enterprise Module for Basesystem 15 SP6 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Linux Enterprise Module for Legacy 15 SP6 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP4-LTSS / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP4 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Manager Proxy 4.3 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Manager%20Proxy%204.3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

SUSE:Manager Server 4.3 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Manager%20Server%204.3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2"
        }
    ]
}

openSUSE:Leap 15.5 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/opensuse/java-17-openjdk&distro=openSUSE%20Leap%2015.5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-src": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-javadoc": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-jmods": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2"
        }
    ]
}

openSUSE:Leap 15.6 / java-17-openjdk

Package

Name: java-17-openjdk
Purl: pkg:rpm/opensuse/java-17-openjdk&distro=openSUSE%20Leap%2015.6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

17.0.13.0-150400.3.48.2

Ecosystem specific

{
    "binaries": [
        {
            "java-17-openjdk-src": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-headless": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-demo": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-devel": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-javadoc": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk-jmods": "17.0.13.0-150400.3.48.2",
            "java-17-openjdk": "17.0.13.0-150400.3.48.2"
        }
    ]
}