Headline

RHSA-2022:1490: Red Hat Security Advisory: java-1.8.0-openjdk security update

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-21426: OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)
CVE-2022-21434: OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)
CVE-2022-21443: OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151)
CVE-2022-21476: OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008)
CVE-2022-21496: OpenJDK: URI parsing inconsistencies (JNDI, 8278972)

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #apache #java

Synopsis

Important: java-1.8.0-openjdk security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476)
OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) (CVE-2022-21426)
OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672) (CVE-2022-21434)
OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443)
OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
Red Hat Enterprise Linux Server - AUS 8.4 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat Enterprise Linux Server - TUS 8.4 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions 8.4 x86_64
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64

Fixes

BZ - 2075788 - CVE-2022-21426 OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)
BZ - 2075793 - CVE-2022-21443 OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151)
BZ - 2075836 - CVE-2022-21434 OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)
BZ - 2075842 - CVE-2022-21476 OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008)
BZ - 2075849 - CVE-2022-21496 OpenJDK: URI parsing inconsistencies (JNDI, 8278972)

CVEs

CVE-2022-21426
CVE-2022-21434
CVE-2022-21443
CVE-2022-21476
CVE-2022-21496

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM

java-1.8.0-openjdk-1.8.0.332.b09-1.el8_4.src.rpm

SHA-256: 1731b9fd9f68f4f11dac1665d6f72ae6b4dded84630b3e1857705991e4615c78

x86_64

java-1.8.0-openjdk-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: fb2d0760c8d5bbb1c7018187c0afcf83695b45cb2fd740f6145167a5bc54ddda

java-1.8.0-openjdk-accessibility-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 3b9de913d0b50b330aec6e74c037f7746d06e43f8850aeb200215cde0cfed7c8

java-1.8.0-openjdk-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 71dcdbef3b72193d2964927a9ed570166f285a4601e7b7aa545ec3720a4102ff

java-1.8.0-openjdk-debugsource-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: f58eb4bbd8c3c26fd974280edc1db70f0bb31dfb3c62178b61bb32de2e9931c0

java-1.8.0-openjdk-demo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 4c8d6a25de10222fc873712e8a09ec630ff7e5867a2e866e237d473e34916cd8

java-1.8.0-openjdk-demo-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 019ca59c7f48d30b921351b758e733c6c02f30db61587d790c1e603db88cdc5a

java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 951ae6df51407c34a8709d3d78f7d05ca489594376feb8fc6a7e0511fabb455b

java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: d7cec6df8593cb57520fc2d288cde5c715d6cb17c9cfc5f5337763ed9aa199c7

java-1.8.0-openjdk-devel-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 2169e83ed967a7c56641ca69128401f821fac6e4c7dc8590c73d65cbdedde88b

java-1.8.0-openjdk-devel-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: be54867ea81c21d69e13d986ce925cebc5881738837cacd38059b88ca31ac71e

java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 21baa83e2b150a1e2ede8c56aa6bc1a1d6a6bff5a9f037bcfdaa7c18026384e8

java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 8ecf762fd9e246cedf5d1d85e170b57311457c9f6f4b6522d0d484d3582bf928

java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: f64eb861b53c36248eb3f610610b9d84e92149f8dc76e7d2b7bbc2c7bdf8dc54

java-1.8.0-openjdk-headless-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: be3347597ab6ecf2a9e90f008d9ae6c12779bda9ae53b2a685c828e65025244c

java-1.8.0-openjdk-headless-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 80366887876480727a8db8a11ad91d29d87d8c1dbad5cce61de4ff853ada53a5

java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 17c83670e3ade8aa2d2d5c0a2521394821597d35aa3c79d12780be195febe49a

java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: cbab5a8a243978f346fa67b91933f2b6a2f9dbc40c525551723752ed36a77d7d

java-1.8.0-openjdk-javadoc-1.8.0.332.b09-1.el8_4.noarch.rpm

SHA-256: 4295e72ed0b9f490ceed84f1738c6f7067acd7b24f01afdc067946e11fbbeada

java-1.8.0-openjdk-javadoc-zip-1.8.0.332.b09-1.el8_4.noarch.rpm

SHA-256: 9be27c9dd956b638666ed26b8ef5c43249edd5ea94b34b525137c8235af8a604

java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 0763a7bf699483b7ee8fa99781bdeb95dbbdffd02399cf0154875811cf568367

java-1.8.0-openjdk-src-1.8.0.332.b09-1.el8_4.x86_64.rpm

SHA-256: 57eee22f329145847d0f61237760415c927b5464ea7f8de33c3312b9a2c644ac

Red Hat Enterprise Linux Server - AUS 8.4