Headline

RHSA-2022:0305: Red Hat Security Advisory: java-1.8.0-openjdk security update

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-21248: OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)
CVE-2022-21282: OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)
CVE-2022-21283: OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813)
CVE-2022-21293: OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)
CVE-2022-21294: OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416)
CVE-2022-21296: OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
CVE-2022-21299: OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)
CVE-2022-21305: OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
CVE-2022-21340: OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)
CVE-2022-21341: OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236)
CVE-2022-21360: OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
CVE-2022-21365: OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)

3 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #java

Synopsis

Moderate: java-1.8.0-openjdk security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934) (CVE-2022-21248)
OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492) (CVE-2022-21282)
OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813) (CVE-2022-21283)
OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392) (CVE-2022-21293)
OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416) (CVE-2022-21294)
OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498) (CVE-2022-21296)
OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646) (CVE-2022-21299)
OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014) (CVE-2022-21305)
OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026) (CVE-2022-21340)
OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236) (CVE-2022-21341)
OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756) (CVE-2022-21360)
OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838) (CVE-2022-21365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
Red Hat Enterprise Linux Server - AUS 8.2 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
Red Hat Enterprise Linux Server - TUS 8.2 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.2 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.2 x86_64

Fixes

BZ - 2041400 - CVE-2022-21283 OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813)
BZ - 2041417 - CVE-2022-21293 OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)
BZ - 2041427 - CVE-2022-21294 OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416)
BZ - 2041435 - CVE-2022-21282 OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)
BZ - 2041439 - CVE-2022-21296 OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
BZ - 2041472 - CVE-2022-21299 OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)
BZ - 2041491 - CVE-2022-21360 OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
BZ - 2041785 - CVE-2022-21365 OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)
BZ - 2041801 - CVE-2022-21248 OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)
BZ - 2041878 - CVE-2022-21305 OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
BZ - 2041884 - CVE-2022-21340 OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)
BZ - 2041897 - CVE-2022-21341 OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236)

CVEs

CVE-2022-21248
CVE-2022-21282
CVE-2022-21283
CVE-2022-21293
CVE-2022-21294
CVE-2022-21296
CVE-2022-21299
CVE-2022-21305
CVE-2022-21340
CVE-2022-21341
CVE-2022-21360
CVE-2022-21365

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2

SRPM

java-1.8.0-openjdk-1.8.0.322.b06-1.el8_2.src.rpm

SHA-256: 1555c1bea9c78eed962577988ccda1751fcf92fcf26dcd00edbfc0c62a71afba

x86_64

java-1.8.0-openjdk-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 7f076d6f2d4ca2e886dbfe7c7b45395598b90369b902b673e7b857e92d2ceabf

java-1.8.0-openjdk-accessibility-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 378bba79fee5f512cc6f8f8e2c8d5a7a1d5a8712069150d777355587ca138ef7

java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 37c245241b89a567e0ad6203a637d014a1163a1c237e442d1b19006e0604906d

java-1.8.0-openjdk-debugsource-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 89f5d9f872226fc3cfcacbf3b8cb0030bb65b9896fd946891411e941f0261888

java-1.8.0-openjdk-demo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 3c334024c5d402088aa28f39982fb20222903a579fe74347a1eaf2b7f4673234

java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 4d0399ee5aca08f3330fc8899b79b9e5cf00d272efea2292be5695d96de1d532

java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: e9c54571d62930f702f7b12d75b1094c88365f478c0605bf01db473602b2760e

java-1.8.0-openjdk-devel-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 37a5ec92b49ba17fbff449079536fb92c961eed35996a3d01e11d1f4602ab7d5

java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 85612a439db442bf383e6e40a54dce5731b388111998c0f972264bfa56a68cae

java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 37fdf6f94a2285ad69d303c4178c91b8056b4c448ffe4e723d9b90ce69f5ac7a

java-1.8.0-openjdk-headless-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: f9ead799402e37ec2ffc9eb3360058e43a67deff6e4c69997bb92c3d18fd57d5

java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: fe1f1e15417e9c679da11eadd5624dddc553051946a573e659074a102400b82c

java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: ea05cfb1a678a2f169fbdc4e795e8f0698975f8dadbe0f90dd194ad61f6878a1

java-1.8.0-openjdk-javadoc-1.8.0.322.b06-1.el8_2.noarch.rpm

SHA-256: 418d3d82e8715e9eb8b60f9d632e70e2d386f8e24637512f5458f882990387c0

java-1.8.0-openjdk-javadoc-zip-1.8.0.322.b06-1.el8_2.noarch.rpm

SHA-256: bb3cd6668ae7e7315e64883a3e0d589f86dbe0746b6251273a676e103aeb1bc8

java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 6ff0f59b71c57ca1086c44992664d81b7a954ee804256095c8a4b337e6822825

java-1.8.0-openjdk-src-1.8.0.322.b06-1.el8_2.x86_64.rpm

SHA-256: 4fd63585a4f670164820f58658a95d73272f04f52fa7344f7e76a6d5297e5659

Red Hat Enterprise Linux Server - AUS 8.2