-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: java-1.8.0-openjdk security update
Advisory ID:       RHSA-2023:1911-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1911
Issue date:        2023-04-25
CVE Names:         CVE-2023-21930 CVE-2023-21937 CVE-2023-21938 
                   CVE-2023-21939 CVE-2023-21954 CVE-2023-21967 
                   CVE-2023-21968 
====================================================================
1. Summary:

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise
Linux 8.1 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime
Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

* OpenJDK: improper connection handling during TLS handshake (8294474)
(CVE-2023-21930)

* OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939)

* OpenJDK: incorrect enqueue of references in garbage collector (8298191)
(CVE-2023-21954)

* OpenJDK: certificate validation issue in TLS session negotiation
(8298310) (CVE-2023-21967)

* OpenJDK: missing string checks for NULL characters (8296622)
(CVE-2023-21937)

* OpenJDK: incorrect handling of NULL characters in ProcessBuilder
(8295304) (CVE-2023-21938)

* OpenJDK: missing check for slash characters in URI-to-path conversion
(8298667) (CVE-2023-21968)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2187435 - CVE-2023-21930 OpenJDK: improper connection handling during TLS handshake (8294474)
2187441 - CVE-2023-21954 OpenJDK: incorrect enqueue of references in garbage collector (8298191)
2187704 - CVE-2023-21967 OpenJDK: certificate validation issue in TLS session negotiation (8298310)
2187724 - CVE-2023-21939 OpenJDK: Swing HTML parsing issue (8296832)
2187758 - CVE-2023-21938 OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304)
2187790 - CVE-2023-21937 OpenJDK: missing string checks for NULL characters (8296622)
2187802 - CVE-2023-21968 OpenJDK: missing check for slash characters in URI-to-path conversion (8298667)

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:
java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.src.rpm

aarch64:
java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm
java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.aarch64.rpm

noarch:
java-1.8.0-openjdk-javadoc-1.8.0.372.b07-1.el8_1.noarch.rpm
java-1.8.0-openjdk-javadoc-zip-1.8.0.372.b07-1.el8_1.noarch.rpm

ppc64le:
java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm
java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.ppc64le.rpm

s390x:
java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm
java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.s390x.rpm

x86_64:
java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm
java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-21930
https://access.redhat.com/security/cve/CVE-2023-21937
https://access.redhat.com/security/cve/CVE-2023-21938
https://access.redhat.com/security/cve/CVE-2023-21939
https://access.redhat.com/security/cve/CVE-2023-21954
https://access.redhat.com/security/cve/CVE-2023-21967
https://access.redhat.com/security/cve/CVE-2023-21968
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZEgue9zjgjWX9erEAQiNng/+Na7FF9ZJt2OPlvMgG3pBVJ5n5JlhFDRp
uwgOPLBpQ+2cOPbEHx1DPzUDg410+h5c7g4pDsTNqQCvLpgIjUbXoPj0tF+xwKEi
hKoqI07lOewIjWf9dD8LHiSXJOHpaDZ30+494Ufkn/tqsdyRNQJiDBJXINUp0BI9
MGz5n/1sMU8Gcqgwmmi6W7Sq72wGdu+I1ozdS9ivukqJ9j0l5vNNsellSAk8+Cly
GoL4hXMyfVpbjhmB/NHvO79TLzo9VrYjCPN9lO0S9mBGn0xvcsnEc1yQrGIn0fLb
yU1ualEGZ5RVncXiKN/FLyJoexq/59cV66jHs5qbtj2YI8eEbU9JZN6uwnGJ1I8G
CqEmwF6m5GEdGQyaheTQZU3hoLek2EFhbqrZ1e9lsE4StVLDg0tkZjMLNaFLBzSN
ik373Tu6TkNdQ3kGjtAqMFmCv5IY9aUhJzqQDdCpaYQU9USpID636rr9+Qsblm4F
vwwtv6g2WuJjzECrPtIa5iUZBwJT8NpC0uZYU1tXe9j3msKArDk52DcmxJ9DZ8S8
oSBHGHXu+VmFdG3tzx8U5c+g6pSQY9w3lFMlSuVJCyx2z8zwhiwgjio29y7SXHzw
aYOVQHoZPMBN9WBvenDlqmQC40D/g82LBFIzEzJF0QRCCAZ+89qB6C4g8TFwKtDd
A2t9ncHN120=/t5p
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-1911:01 Important: java-1.8.0-openjdk security update

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Summary

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
* OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930)
* OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939)
* OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954)
* OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967)
* OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937)
* OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938)
* OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of OpenJDK Java must be restarted for this update to take effect.

References

https://access.redhat.com/security/cve/CVE-2023-21930 https://access.redhat.com/security/cve/CVE-2023-21937 https://access.redhat.com/security/cve/CVE-2023-21938 https://access.redhat.com/security/cve/CVE-2023-21939 https://access.redhat.com/security/cve/CVE-2023-21954 https://access.redhat.com/security/cve/CVE-2023-21967 https://access.redhat.com/security/cve/CVE-2023-21968 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream E4S (v. 8.1):
Source: java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.src.rpm
aarch64: java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.aarch64.rpm
noarch: java-1.8.0-openjdk-javadoc-1.8.0.372.b07-1.el8_1.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.372.b07-1.el8_1.noarch.rpm
ppc64le: java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.ppc64le.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.ppc64le.rpm
s390x: java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.s390x.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.s390x.rpm
x86_64: java-1.8.0-openjdk-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-debugsource-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-demo-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-devel-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-headless-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.372.b07-1.el8_1.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-1.el8_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2023:1911-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1911
Issued Date: : 2023-04-25
CVE Names: CVE-2023-21930 CVE-2023-21937 CVE-2023-21938 CVE-2023-21939 CVE-2023-21954 CVE-2023-21967 CVE-2023-21968

Topic

An update for java-1.8.0-openjdk is now available for Red Hat EnterpriseLinux 8.1 Update Services for SAP Solutions.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64


Bugs Fixed

2187435 - CVE-2023-21930 OpenJDK: improper connection handling during TLS handshake (8294474)

2187441 - CVE-2023-21954 OpenJDK: incorrect enqueue of references in garbage collector (8298191)

2187704 - CVE-2023-21967 OpenJDK: certificate validation issue in TLS session negotiation (8298310)

2187724 - CVE-2023-21939 OpenJDK: Swing HTML parsing issue (8296832)

2187758 - CVE-2023-21938 OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304)

2187790 - CVE-2023-21937 OpenJDK: missing string checks for NULL characters (8296622)

2187802 - CVE-2023-21968 OpenJDK: missing check for slash characters in URI-to-path conversion (8298667)


Related News

23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved