Headline

RHSA-2022:0312: Red Hat Security Advisory: java-1.8.0-openjdk security update

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-21248: OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)
CVE-2022-21282: OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)
CVE-2022-21283: OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813)
CVE-2022-21293: OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)
CVE-2022-21294: OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416)
CVE-2022-21296: OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
CVE-2022-21299: OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)
CVE-2022-21305: OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
CVE-2022-21340: OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)
CVE-2022-21341: OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236)
CVE-2022-21360: OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
CVE-2022-21365: OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)

3 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #java

Synopsis

Moderate: java-1.8.0-openjdk security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934) (CVE-2022-21248)
OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492) (CVE-2022-21282)
OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813) (CVE-2022-21283)
OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392) (CVE-2022-21293)
OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416) (CVE-2022-21294)
OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498) (CVE-2022-21296)
OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646) (CVE-2022-21299)
OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014) (CVE-2022-21305)
OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026) (CVE-2022-21340)
OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236) (CVE-2022-21341)
OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756) (CVE-2022-21360)
OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838) (CVE-2022-21365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
Red Hat Enterprise Linux Server - AUS 8.4 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat Enterprise Linux Server - TUS 8.4 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4 x86_64
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64

Fixes

BZ - 2041400 - CVE-2022-21283 OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813)
BZ - 2041417 - CVE-2022-21293 OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)
BZ - 2041427 - CVE-2022-21294 OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416)
BZ - 2041435 - CVE-2022-21282 OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)
BZ - 2041439 - CVE-2022-21296 OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
BZ - 2041472 - CVE-2022-21299 OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)
BZ - 2041491 - CVE-2022-21360 OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
BZ - 2041785 - CVE-2022-21365 OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)
BZ - 2041801 - CVE-2022-21248 OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)
BZ - 2041878 - CVE-2022-21305 OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
BZ - 2041884 - CVE-2022-21340 OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)
BZ - 2041897 - CVE-2022-21341 OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236)

CVEs

CVE-2022-21248
CVE-2022-21282
CVE-2022-21283
CVE-2022-21293
CVE-2022-21294
CVE-2022-21296
CVE-2022-21299
CVE-2022-21305
CVE-2022-21340
CVE-2022-21341
CVE-2022-21360
CVE-2022-21365

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM

java-1.8.0-openjdk-1.8.0.322.b06-2.el8_4.src.rpm

SHA-256: c397db9cdc113a22e4d546bb269ba1fa56740b2a5518d1f7af9ceadcc43be691

x86_64

java-1.8.0-openjdk-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 1f8dfb2164c6d2cd3b3181960db43160760415da913e55ec8aff14afb29f2e03

java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 9861b08946fb6276620e1a57bc9e609302993711aaca97cff012124371476f7b

java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 0921bff527725a0902f00946b9ac16fec560b0761bfae776e41ac99befe8b862

java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 6b5175cb6451f3a5e71599728d42dfa998a94e9cfb3047fdcc29a886ada70138

java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: ab17502a4cd786551a42e5f7aa9585f730c796ff8efc402b58eaa0216cb244e3

java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 4017d0e32ab825abeb0eb127d06824a24cc202ba161b60b12465832cfc75fa0c

java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: c7b7345009fe15330d636f0224cd6ecbb375c1a43488465cd3dbefe51320f0c3

java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: fc71cffb9fee212837ea67bd5f74e9190ae80536ab86e6a810e44049f1679215

java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 116701b013c2eaf101097941fd92ad0baeb5bd5ee6b727ab88e8f7eb9d98e130

java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: d68398ef1411ac880ec14277e1bcc4c21be3937d62772048426e58e6d06b4ae7

java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 37650458428b12198fdac01fd379d8279c093801d6f323ee7014518b6a94db74

java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 8cccbe4733aded76bd8c27250436c2b1f53e7f6c41bfdbbf67cffc2872a5b72f

java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 0408348c7577549b6e68e8fd02628b0cdc9e0f3ead31649d3f44c8c29c084d35

java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 0047f19963a3780506b050d32530766938e53de127e9204367fa8f107f7a4ac6

java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: c42b8e2ee59b88abb8507c4f16491460fba8fbbd47cd37fe9d2f4697d1f3b3d2

java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: fdad995436f5f0feea5330f02a857acdcc6cd01227efa3a82ee9ddcb36dd5bf1

java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: aec8cc913af03996297a502b60c540dc77ce6f1563ad176b65adb2fa6b99e3ce

java-1.8.0-openjdk-javadoc-1.8.0.322.b06-2.el8_4.noarch.rpm

SHA-256: 2f8d5258eef6e145bb3c9d8f11e796a3cbcb1c187b100820858a664d9b53637f

java-1.8.0-openjdk-javadoc-zip-1.8.0.322.b06-2.el8_4.noarch.rpm

SHA-256: 7a6306cc7a079e10462ffeb6b9e7dfea13bf59ae80cc089a0448a20fbc230ad2

java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 1d5ae53b568478f319ee4565859a6ba4b1080d2c489896db72f3112bd86fe2d2

java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_4.x86_64.rpm

SHA-256: 0e4eaf8bdd09a8299b34cde7529e2ae89abff5d0b2f91a98a4983c2505a03a3d

Red Hat Enterprise Linux Server - AUS 8.4