Ubuntu 22.04 LTS: USN-5546-1 Critical OpenJDK DoS Threats

ubuntu

August 4, 2022

Several security issues were fixed in OpenJDK.

Summary

Several security issues were fixed in OpenJDK.

Software Description:

- openjdk-17: Open Source Java implementation

- openjdk-18: Open Source Java implementation

- openjdk-8: Open Source Java implementation

- openjdk-lts: Open Source Java implementation

Details:

Neil Madden discovered that OpenJDK did not properly verify ECDSA

signatures. A remote attacker could possibly use this issue to insert,

edit or obtain sensitive information. This issue only affected OpenJDK

17 and OpenJDK 18. (CVE-2022-21449)

It was discovered that OpenJDK incorrectly limited memory when compiling a

specially crafted XPath expression. An attacker could possibly use this

issue to cause a denial of service. This issue was fixed in OpenJDK 8 and

OpenJDK 18. USN-5388-1 and USN-5388-2 addressed this issue in OpenJDK 11

and OpenJDK 17. (CVE-2022-21426)

It was discovered that OpenJDK incorrectly handled converting certain

object arguments into their textual representations. An attacker could

possibly use this...

Read the Full Advisory

Topics Covered

security advisory critical DoS Ubuntu OpenJDK

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  openjdk-11-jdk                  11.0.16+8-0ubuntu1~22.04
  openjdk-11-jre                  11.0.16+8-0ubuntu1~22.04
  openjdk-11-jre-headless         11.0.16+8-0ubuntu1~22.04
  openjdk-11-jre-zero             11.0.16+8-0ubuntu1~22.04
  openjdk-17-jdk                  17.0.4+8-1~22.04
  openjdk-17-jre                  17.0.4+8-1~22.04
  openjdk-17-jre-headless         17.0.4+8-1~22.04
  openjdk-17-jre-zero             17.0.4+8-1~22.04
  openjdk-18-jdk                  18.0.2+9-2~22.04
  openjdk-18-jre                  18.0.2+9-2~22.04
  openjdk-18-jre-headless         18.0.2+9-2~22.04
  openjdk-18-jre-zero             18.0.2+9-2~22.04
  openjdk-8-jdk                   8u342-b07-0ubuntu1~22.04
  openjdk-8-jre                   8u342-b07-0ubuntu1~22.04
  openjdk-8-jre-headless          8u342-b07-0ubuntu1~22.04
  openjdk-8-jre-zero              8u342-b07-0ubuntu1~22.04

Ubuntu 20.04 LTS:
  openjdk-11-jdk                  11.0.16+8-0ubuntu1~20.04
  openjdk-11-jre                  11.0.16+8-0ubuntu1~20.04
  openjdk-11-jre-headless         11.0.16+8-0ubuntu1~20.04
  openjdk-11-jre-zero             11.0.16+8-0ubuntu1~20.04
  openjdk-17-jdk                  17.0.4+8-1~20.04
  openjdk-17-jre                  17.0.4+8-1~20.04
  openjdk-17-jre-headless         17.0.4+8-1~20.04
  openjdk-17-jre-zero             17.0.4+8-1~20.04
  openjdk-8-jdk                   8u342-b07-0ubuntu1~20.04
  openjdk-8-jre                   8u342-b07-0ubuntu1~20.04
  openjdk-8-jre-headless          8u342-b07-0ubuntu1~20.04
  openjdk-8-jre-zero              8u342-b07-0ubuntu1~20.04

Ubuntu 18.04 LTS:
  openjdk-11-jdk                  11.0.16+8-0ubuntu1~18.04
  openjdk-11-jre                  11.0.16+8-0ubuntu1~18.04
  openjdk-11-jre-headless         11.0.16+8-0ubuntu1~18.04
  openjdk-11-jre-zero             11.0.16+8-0ubuntu1~18.04
  openjdk-17-jdk                  17.0.4+8-1~18.04
  openjdk-17-jre                  17.0.4+8-1~18.04
  openjdk-17-jre-headless         17.0.4+8-1~18.04
  openjdk-17-jre-zero             17.0.4+8-1~18.04
  openjdk-8-jdk                   8u342-b07-0ubuntu1~18.04
  openjdk-8-jre                   8u342-b07-0ubuntu1~18.04
  openjdk-8-jre-headless          8u342-b07-0ubuntu1~18.04
  openjdk-8-jre-zero              8u342-b07-0ubuntu1~18.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.