Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

openSUSE: 2024:0325-1 Important: Java-17-OpenJDK Critical Fix

opensuse
Calendar Grey February 5, 2024
Dist Opensuse Esm H88
Java 17 OpenJDK gets crucial security patches tackling various weaknesses within openSUSE systems.
This update for java-17-openjdk fixes the following issues: Updated to version 17.0.10 (January 2024 CPU):

Description

This update for java-17-openjdk fixes the following issues:

Updated to version 17.0.10 (January 2024 CPU):

* CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a

missing bounds check (bsc#1218907).

* CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file

verifier (bsc#1218903).

* CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that

could lead to corruption of JVM memory (bsc#1218905).

* CVE-2024-20932: Fixed an incorrect handling of ZIP files with duplicate

entries (bsc#1218908).

* CVE-2024-20945: Fixed a potential private key leak through debug logs

(bsc#1218909).

* CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack

against TLS (bsc#1218911).

Find the full release notes at:

https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029089.html

Topics%20covered

Topics Covered

security advisory critical memory corruption security fix important openSUSE java-17-openjdk

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch SUSE-2024-325=1

* openSUSE Leap 15.5

zypper in -t patch openSUSE-SLE-15.5-2024-325=1

* Basesystem Module 15-SP5

zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-325=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-325=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-325=1

* SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4

zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-325=1

* SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-325=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

zypper in -t patch...

Read the Full Advisory

Package List

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)

* java-17-openjdk-jmods-17.0.10.0-150400.3.36.1

* java-17-openjdk-demo-17.0.10.0-150400.3.36.1

* java-17-openjdk-devel-17.0.10.0-150400.3.36.1

* java-17-openjdk-17.0.10.0-150400.3.36.1

* java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

* java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1

* java-17-openjdk-src-17.0.10.0-150400.3.36.1

* java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

* java-17-openjdk-headless-17.0.10.0-150400.3.36.1

* java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

* openSUSE Leap 15.4 (noarch)

* java-17-openjdk-javadoc-17.0.10.0-150400.3.36.1

* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

* java-17-openjdk-jmods-17.0.10.0-150400.3.36.1

* java-17-openjdk-demo-17.0.10.0-150400.3.36.1

* java-17-openjdk-devel-17.0.10.0-150400.3.36.1

* java-17-openjdk-17.0.10.0-150400.3.36.1

* java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

* java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1

*...

Read the Full Advisory

References

* bsc#1218903

* bsc#1218905

* bsc#1218907

* bsc#1218908

* bsc#1218909

* bsc#1218911

## References:

* https://www.suse.com/security/cve/CVE-2024-20918.html

* https://www.suse.com/security/cve/CVE-2024-20919.html

* https://www.suse.com/security/cve/CVE-2024-20921.html

* https://www.suse.com/security/cve/CVE-2024-20932.html

* https://www.suse.com/security/cve/CVE-2024-20945.html

* https://www.suse.com/security/cve/CVE-2024-20952.html

* https://bugzilla.suse.com/show_bug.cgi?id=1218903

* https://bugzilla.suse.com/show_bug.cgi?id=1218905

* https://bugzilla.suse.com/show_bug.cgi?id=1218907

* https://bugzilla.suse.com/show_bug.cgi?id=1218908

* https://bugzilla.suse.com/show_bug.cgi?id=1218909

* https://bugzilla.suse.com/show_bug.cgi?id=1218911

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:0325-1
Rating: important

Topics%20covered

Topics Covered

security advisory critical memory corruption security fix important openSUSE java-17-openjdk

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here