ArchLinux: 202107-65: jre-openjdk-headless: multiple issues
Summary
- CVE-2021-2341 (information disclosure)
A security issue has been found in the Networking component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit
vulnerability allows an unauthenticated attacker with network access
via multiple protocols to compromise OpenJDK. Successful attacks
require human interaction from a person other than the attacker.
Successful attacks of this vulnerability can result in unauthorized
read access to a subset of OpenJDK accessible data.
Note: This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).
- CVE-2021-2369 (arbitrary code execution)
A security issue has been found in the Library component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. An easily exploitable
vulnerability allows unauthenticated attacker with network access via
multiple protocols to compromise OpenJDK. Successful attacks require
human interaction from a person other than the attacker. Successful
attacks of this vulnerability can result in unauthorized update, insert
or delete access to some of the OpenJDK accessible data.
Note : This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).
- CVE-2021-2388 (arbitrary code execution)
A security issue has been found in the Hotspot component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit
vulnerability allows unauthenticated attacker with network access via
multiple protocols to compromise OpenJDK. Successful attacks require
human interaction from a person other than the attacker. Successful
attacks of this vulnerability can result in takeover of OpenJDK.
Note : This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).
Resolution
Upgrade to 16.0.2.u7-1.
# pacman -Syu "jre-openjdk-headless>=16.0.2.u7-1"
The problems have been fixed upstream in version 16.0.2.u7.
References
https://openjdk.org/groups/vulnerability/advisories/2021-07-20 https://www.oracle.com/security-alerts/cpujul2021verbose.html#JAVA https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8258432 https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8260967 https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8264066 https://security.archlinux.org/CVE-2021-2341 https://security.archlinux.org/CVE-2021-2369 https://security.archlinux.org/CVE-2021-2388
Workaround
None.
