Synopsis:          Moderate: java-11-openjdk security and bug fix update
Advisory ID:       SLSA-2022:7008-1
Issue Date:        2022-10-20
CVE Numbers:       CVE-2022-21619
                   CVE-2022-21626
                   CVE-2022-21624
                   CVE-2022-21628
                   CVE-2022-39399
                   CVE-2022-21618
--

Security Fix(es):

* OpenJDK: improper MultiByte conversion can lead to buffer overflow
(JGSS,  8286077) (CVE-2022-21618)

* OpenJDK: excessive memory allocation in X.509 certificate parsing
(Security, 8286533) (CVE-2022-21626)

* OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server,
8286918) (CVE-2022-21628)

* OpenJDK: improper handling of long NTLM client hostnames (Security,
8286526) (CVE-2022-21619)

* OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI,
8286910) (CVE-2022-21624)

* OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366)
(CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE

Bug Fix(es):

* Prepare for the next quarterly OpenJDK upstream release (2022-10,
11.0.17)
--

SL7
  x86_64
    java-11-openjdk-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-debuginfo-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-debuginfo-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-headless-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-headless-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-demo-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-demo-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-devel-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-devel-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-javadoc-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-javadoc-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-javadoc-zip-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-javadoc-zip-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-jmods-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-jmods-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-src-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-src-11.0.17.0.8-2.el7_9.x86_64.rpm
    java-11-openjdk-static-libs-11.0.17.0.8-2.el7_9.i686.rpm
    java-11-openjdk-static-libs-11.0.17.0.8-2.el7_9.x86_64.rpm

- Scientific Linux Development Team

SciLinux: SLSA-2022-7008-1 Moderate: java-11-openjdk on SL7.x x86_64

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8...

Summary

Moderate: java-11-openjdk security and bug fix update



Security Fixes

* OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
* OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
* OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
* OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
* OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
* OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE

Severity
Advisory ID: SLSA-2022:7008-1
Issued Date: : 2022-10-20
CVE Numbers: CVE-2022-21619
CVE-2022-21626
CVE-2022-21624

Related News

11.Locks IsometricPattern Esm H320
2 - 3 min read
The upcoming release of Linux Mint 22 will introduce significant changes, particularly in handling XApp , GNOME applications, and the Software
2.Motherboard Esm H320
2 - 3 min read
German software engineer Lennart Poettering recently presented run0 , a new tool in systemd v256 that aims to address the security concerns
22.Lock ScreenEffect Esm H320
2 - 3 min read
Red Hat recently released its newest enterprise Linux distro, Red Hat Enterprise Linux (RHEL) 9.4 , which introduces several features designed to
8.Locks HexConnections CodeGlobe Esm H320
1 - 2 min read
The latest release of Debian , one of the oldest and most trusted distributions within the Linux ecosystem, redefines security, stability, and
20.Lock AbstractDigital Circular Esm H320
1 - 2 min read
The Ubuntu security team has recently discovered and addressed multiple vulnerabilities in the Apache HTTP Server. The vulnerabilities affected
1.Penguin Landscape Esm H320
1 - 2 min read
A critical vulnerability was discovered in the Linux kernel's netfilter subsystem, specifically within the nf_tables component, posing potential
19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved