Headline
RHSA-2023:4163: Red Hat Security Advisory: java-11-openjdk security and bug fix update
An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
- CVE-2023-22036: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
- CVE-2023-22041: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CVE-2023-22045: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- CVE-2023-22049: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
- CVE-2023-25193: A vulnerability was found HarfBuzz. This flaw allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Quarkus
Integration and Automation
All Products
Issued:
2023-07-19
Updated:
2023-07-19
RHSA-2023:4163 - Security Advisory
- Overview
- Updated Packages
Synopsis
Moderate: java-11-openjdk security and bug fix update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
Security Fix(es):
- OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
- OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
- OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
- harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
- OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
- OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime() method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the fix has been reverted in JDK 11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222495)
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of OpenJDK Java must be restarted for this update to take effect.
Affected Products
- Red Hat Enterprise Linux Server - AUS 8.4 x86_64
- Red Hat Enterprise Linux Server - TUS 8.4 x86_64
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
Fixes
- BZ - 2167254 - CVE-2023-25193 harfbuzz: OpenJDK: O(n^2) growth via consecutive marks
- BZ - 2221619 - OpenJDK: font processing denial of service vulnerability (8301998)
- BZ - 2221626 - CVE-2023-22006 OpenJDK: HTTP client insufficient file name validation (8302475)
- BZ - 2221634 - CVE-2023-22036 OpenJDK: ZIP file parsing infinite loop (8302483)
- BZ - 2221645 - CVE-2023-22045 OpenJDK: array indexing integer overflow issue (8304468)
- BZ - 2221647 - CVE-2023-22049 OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312)
- BZ - 2222495 - SIGSEGV (duplicated predicate failed) in java.util.GregorianCalendar.computeTime() [rhel-8, openjdk-11] [rhel-8.4.0.z]
- BZ - 2223207 - CVE-2023-22041 OpenJDK: weakness in AES implementation (8308682)
CVEs
- CVE-2023-22006
- CVE-2023-22036
- CVE-2023-22041
- CVE-2023-22045
- CVE-2023-22049
- CVE-2023-25193
Red Hat Enterprise Linux Server - AUS 8.4
SRPM
java-11-openjdk-11.0.20.0.8-1.el8_4.src.rpm
SHA-256: ae81aceafbbb6c68f3fafab763b504023b9a1208b39bd6e16f62722e575a6336
x86_64
java-11-openjdk-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 64ee762730b7c2573a329a1db53e2290f4253f74e4d7a6eddd5ce1a084a66f5c
java-11-openjdk-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 93b4c1c38dcf7371cf9d9eb907f3846a03bb294dbed0cce1eaf97ea3fe3d756f
java-11-openjdk-debugsource-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: ab4f2be68b2a9b3c90e8da910a09b979fa5d0a8133d94a7fcf3abecadf88c2fa
java-11-openjdk-demo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 605aa71b6cec5137039ccb98232b77fc452239cf29b526b85a8946c64189acb7
java-11-openjdk-devel-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 16604dab9094e3de633cd0199821dd1f513ce19af9f09cca5f405192eba40de1
java-11-openjdk-devel-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: d51a78f17e6b67a0587fa58418666744c799f72dd707b1aa014a4a5b1be6aa3e
java-11-openjdk-devel-fastdebug-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 903134332d0389c74d4f91bdc7893604c5ff3921666291bc654d2f6c6e640314
java-11-openjdk-devel-slowdebug-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 5692cf2fbc5a2da5ccc10f78380a1445cabfa8f70ab8dd2f99c981770438a2ab
java-11-openjdk-fastdebug-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: cb652dd6e72238a94bec703ebfb4bf50a35194875992528fbd796c1b6bae9b6b
java-11-openjdk-headless-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 0f1234b98ef3f3bab1053e148e8ca767efb866c66344092fef334213b539f051
java-11-openjdk-headless-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 9b7bacfa46f7f222d14aaad28b7a4b70e216048a643dcb3b8a71e3eaad3b7cea
java-11-openjdk-headless-fastdebug-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 63ea80a747000808f405d2c0f5b9dfc98559d56112d9a526232fc4875ac2186a
java-11-openjdk-headless-slowdebug-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 43df2b09ae5a0af62b58650b9399b5088fc2e6162d7c7387ac45287912d94393
java-11-openjdk-javadoc-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 6cd3996f057324070dee222593469193f3eae877f9f017e0fb1f9b707f3cac0f
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 80c9debce0c943c83f621131b392e099aba29dce885c2eacfd91de92ff36db31
java-11-openjdk-jmods-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 65440df035b5d6e422c0fdd7de87d920c88ccf4b5fee52bb30ee7573580dece7
java-11-openjdk-slowdebug-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: b9849049b697c04c361dbdc81a741bf47d48336b1a93cbf7084c93a5b81d9874
java-11-openjdk-src-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 9a4c3394a674888aa62e69140f16b1e6eeb89035790280cf26bd38636ed766dc
java-11-openjdk-static-libs-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 0d50a7c91c2ee0c3cd84843035e82936038db259e17d479c7cda5ad19df68c45
Red Hat Enterprise Linux Server - TUS 8.4
SRPM
java-11-openjdk-11.0.20.0.8-1.el8_4.src.rpm
SHA-256: ae81aceafbbb6c68f3fafab763b504023b9a1208b39bd6e16f62722e575a6336
x86_64
java-11-openjdk-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 64ee762730b7c2573a329a1db53e2290f4253f74e4d7a6eddd5ce1a084a66f5c
java-11-openjdk-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 93b4c1c38dcf7371cf9d9eb907f3846a03bb294dbed0cce1eaf97ea3fe3d756f
java-11-openjdk-debugsource-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: ab4f2be68b2a9b3c90e8da910a09b979fa5d0a8133d94a7fcf3abecadf88c2fa
java-11-openjdk-demo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 605aa71b6cec5137039ccb98232b77fc452239cf29b526b85a8946c64189acb7
java-11-openjdk-devel-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 16604dab9094e3de633cd0199821dd1f513ce19af9f09cca5f405192eba40de1
java-11-openjdk-devel-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: d51a78f17e6b67a0587fa58418666744c799f72dd707b1aa014a4a5b1be6aa3e
java-11-openjdk-headless-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 0f1234b98ef3f3bab1053e148e8ca767efb866c66344092fef334213b539f051
java-11-openjdk-headless-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 9b7bacfa46f7f222d14aaad28b7a4b70e216048a643dcb3b8a71e3eaad3b7cea
java-11-openjdk-javadoc-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 6cd3996f057324070dee222593469193f3eae877f9f017e0fb1f9b707f3cac0f
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 80c9debce0c943c83f621131b392e099aba29dce885c2eacfd91de92ff36db31
java-11-openjdk-jmods-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 65440df035b5d6e422c0fdd7de87d920c88ccf4b5fee52bb30ee7573580dece7
java-11-openjdk-src-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 9a4c3394a674888aa62e69140f16b1e6eeb89035790280cf26bd38636ed766dc
java-11-openjdk-static-libs-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 0d50a7c91c2ee0c3cd84843035e82936038db259e17d479c7cda5ad19df68c45
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4
SRPM
java-11-openjdk-11.0.20.0.8-1.el8_4.src.rpm
SHA-256: ae81aceafbbb6c68f3fafab763b504023b9a1208b39bd6e16f62722e575a6336
ppc64le
java-11-openjdk-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 2c8fb2c8c6b80c71c1c763e227f1713b5025ef16b4c3bcd60b872911c467eae2
java-11-openjdk-debuginfo-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: a006c611098ca89ffb80a013e32ad3a9adb8ea45fca84881cab81221b20704ae
java-11-openjdk-debugsource-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 6ddc4aaf0457c45e027461b91dd38461fd7dbed77b83d8aee838f43a822bdf25
java-11-openjdk-demo-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: d09e43c479866371a77e61aa9eda2b0e3e9319bd404d3e950c5762dc32e99471
java-11-openjdk-devel-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 0c3c2c58acae34489ac59de7f086098d5727d77816dcfac31e6458d6daa9543d
java-11-openjdk-devel-debuginfo-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: c0bbbc3b5d92630cc06595fe3cea8a922170e06ccccb1a7d09ff84b15fe1f954
java-11-openjdk-headless-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: a391ed430b930b029a659847d28047b53f58481db0fb0f8ee6f1c196f607de2e
java-11-openjdk-headless-debuginfo-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 8f4a729434efec3d5e214c17e1648ffa664390743ee0041f4ad334c88e94f2b1
java-11-openjdk-javadoc-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 5171610c469e4641b7bdb1dc0af0645181d7d91b5bb68b38b6230c05e72edb66
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 5fd5d8bfae5d5e521cccb75f2214a479bcdca2068b2361da090ad12922331ce6
java-11-openjdk-jmods-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: e265888acf7fee2fd7eab7c6d5ad4b59d0762fff8baccab464d1cf95c88d288e
java-11-openjdk-src-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 5195b56126cbdc5ce5752b21ac85dec58f8477cb01d2c0af947e486e9279385d
java-11-openjdk-static-libs-11.0.20.0.8-1.el8_4.ppc64le.rpm
SHA-256: 30fac874e9ee0bed4c8f42258fdfa427cb38665b78dd5d284df3a04418441550
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4
SRPM
java-11-openjdk-11.0.20.0.8-1.el8_4.src.rpm
SHA-256: ae81aceafbbb6c68f3fafab763b504023b9a1208b39bd6e16f62722e575a6336
x86_64
java-11-openjdk-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 64ee762730b7c2573a329a1db53e2290f4253f74e4d7a6eddd5ce1a084a66f5c
java-11-openjdk-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 93b4c1c38dcf7371cf9d9eb907f3846a03bb294dbed0cce1eaf97ea3fe3d756f
java-11-openjdk-debugsource-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: ab4f2be68b2a9b3c90e8da910a09b979fa5d0a8133d94a7fcf3abecadf88c2fa
java-11-openjdk-demo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 605aa71b6cec5137039ccb98232b77fc452239cf29b526b85a8946c64189acb7
java-11-openjdk-devel-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 16604dab9094e3de633cd0199821dd1f513ce19af9f09cca5f405192eba40de1
java-11-openjdk-devel-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: d51a78f17e6b67a0587fa58418666744c799f72dd707b1aa014a4a5b1be6aa3e
java-11-openjdk-headless-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 0f1234b98ef3f3bab1053e148e8ca767efb866c66344092fef334213b539f051
java-11-openjdk-headless-debuginfo-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 9b7bacfa46f7f222d14aaad28b7a4b70e216048a643dcb3b8a71e3eaad3b7cea
java-11-openjdk-javadoc-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 6cd3996f057324070dee222593469193f3eae877f9f017e0fb1f9b707f3cac0f
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 80c9debce0c943c83f621131b392e099aba29dce885c2eacfd91de92ff36db31
java-11-openjdk-jmods-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 65440df035b5d6e422c0fdd7de87d920c88ccf4b5fee52bb30ee7573580dece7
java-11-openjdk-src-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 9a4c3394a674888aa62e69140f16b1e6eeb89035790280cf26bd38636ed766dc
java-11-openjdk-static-libs-11.0.20.0.8-1.el8_4.x86_64.rpm
SHA-256: 0d50a7c91c2ee0c3cd84843035e82936038db259e17d479c7cda5ad19df68c45
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Gentoo Linux Security Advisory 202407-24 - A vulnerability has been discovered in HarfBuzz, which can lead to a denial of service. Versions greater than or equal to 7.1.0 are affected.
Release of OpenShift Serverless Operator 1.30.1 and OpenShift Serverless Logic 1.30.0 SP1 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-4853: A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denia...
Red Hat Security Advisory 2023-4877-01 - IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR8-FP10.
Red Hat Security Advisory 2023-4876-01 - IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR8-FP10.
Ubuntu Security Notice 6272-1 - Motoyasu Saburi discovered that OpenJDK 20 incorrectly handled special characters in file name parameters. An attacker could possibly use this issue to insert, edit or obtain sensitive information. Eirik Bjørsnøs discovered that OpenJDK 20 incorrectly handled certain ZIP archives. An attacker could possibly use this issue to cause a denial of service.
Red Hat OpenShift Serverless version 1.29.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. * CVE-2023-24539: A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containin...
Red Hat Security Advisory 2023-4286-01 - Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.
Debian Linux Security Advisory 5458-1 - Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in bypass of sandbox restrictions, information disclosure, reduced cryptographic strength of the AES implementation, directory traversal or denial of service.
Red Hat Security Advisory 2023-4233-01 - The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Issues addressed include denial of service and integer overflow vulnerabilities.
Red Hat Security Advisory 2023-4159-01 - The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Issues addressed include denial of service and integer overflow vulnerabilities.
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22045: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 an...
Red Hat Security Advisory 2023-4158-01 - The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Issues addressed include denial of service and integer overflow vulnerabilities.
Red Hat Security Advisory 2023-4210-01 - The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. This release of the Red Hat build of OpenJDK 17 for portable Linux serves as a replacement for the Red Hat build of OpenJDK 17 and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include denial of service and integer overflow vulnerabilities.
Red Hat Security Advisory 2023-4177-01 - The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Issues addressed include denial of service and integer overflow vulnerabilities.
Red Hat Security Advisory 2023-4211-01 - The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. This release of the Red Hat build of OpenJDK 17 for Windows serves as a replacement for the Red Hat build of OpenJDK 17 and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include denial of service and integer overflow vulnerabilities.
Red Hat Security Advisory 2023-4175-01 - The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Issues addressed include denial of service and integer overflow vulnerabilities.
Red Hat Security Advisory 2023-4176-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include an integer overflow vulnerability.
Red Hat Security Advisory 2023-4208-01 - The OpenJDK 11 packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. This release of the Red Hat build of OpenJDK 11 for portable Linux serves as a replacement for the Red Hat build of OpenJDK 11 and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include denial of service and integer overflow vulnerabilities.
Red Hat Security Advisory 2023-4212-01 - The OpenJDK 8 packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. This release of the Red Hat build of OpenJDK 8 for Windows serves as a replacement for the Red Hat build of OpenJDK 8 and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include an integer overflow vulnerability.
Red Hat Security Advisory 2023-4161-01 - The OpenJDK 11 packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. This release of the Red Hat build of OpenJDK 11 for Windows serves as a replacement for the Red Hat build of OpenJDK 11 and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include denial of service and integer overflow vulnerabilities.
An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauth...
An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauth...
An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauth...
An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22045: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerabili...
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22045: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions ...
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22045: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected...
An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM f...
An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected...
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22045: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3....
An update for java-17-openjdk is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions ...
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to degraded performance and system malfunction.
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.