The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2023-4159 https://linux.oracle.com/errata/ELSA-2023-4159.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable LinuxNetwork: x86_64: java-17-openjdk-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-demo-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-devel-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-headless-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-javadoc-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-javadoc-zip-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-jmods-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-src-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-static-libs-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-demo-fastdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-demo-slowdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-devel-fastdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-devel-slowdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-fastdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-headless-fastdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-headless-slowdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-jmods-fastdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-jmods-slowdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-slowdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-src-fastdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-src-slowdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-static-libs-fastdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm java-17-openjdk-static-libs-slowdebug-17.0.8.0.7-2.0.1.el8.x86_64.rpm aarch64: java-17-openjdk-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-demo-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-devel-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-headless-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-javadoc-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-javadoc-zip-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-jmods-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-src-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-static-libs-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-demo-fastdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-demo-slowdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-devel-fastdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-devel-slowdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-fastdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-headless-fastdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-headless-slowdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-jmods-fastdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-jmods-slowdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-slowdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-src-fastdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-src-slowdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-static-libs-fastdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm java-17-openjdk-static-libs-slowdebug-17.0.8.0.7-2.0.1.el8.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol8/SRPMS-updates//java-17-openjdk-17.0.8.0.7-2.0.1.el8.src.rpm Related CVEs: CVE-2023-22006 CVE-2023-22036 CVE-2023-22041 CVE-2023-22044 CVE-2023-22045 CVE-2023-22049 CVE-2023-25193 Description of changes: [1:17.0.8.0.7-2.0.1] - OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) - OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) - OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) - harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) - OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) - OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044) - OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.8.0.6-0.1.ea] - Update to jdk-17.0.8+6 (EA) - Sync the copy of the portable specfile with the latest update - Resolves: rhbz#2217716 [1:17.0.8.0.1-0.1.ea] - Update to jdk-17.0.8+1 (EA) - Update release notes to 17.0.8+1 - Switch to EA mode - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 17.0.8+1 - Bump bundled LCMS version to 2.15 as in jdk-17.0.8+1. - Bumpbundled HarfBuzz version to 7.0.1 as in jdk-17.0.8+1 - Use tapsets from the misc tarball - Introduce 'prelease' for the portable release versioning, to handle EA builds - Make sure root installation directory is created first - Use in-place substitution for all but the first of the tapset changes - Related: rhbz#2217716 [1:17.0.7.0.7-4] - Introduce vm_variant global for consistency with future JDK builds - Related: rhbz#2203412 [1:17.0.7.0.7-4] - Exclude classes_nocoops.jsa on i686 and arm32 - Related: rhbz#2203412 [1:17.0.7.0.7-4] - Following JDK-8005165, class data sharing can be enabled on all JIT architectures - Related: rhbz#2203412 [1:17.0.7.0.7-4] - Fix packaging of CDS archives - Resolves: rhbz#2203412 _______________________________________________ El-errata mailing list
New Red Hat build of Cryostat 2.3.0 on RHEL 8 container images are now available 2. Description: New Red Hat build of Cryostat 2.3.0 on RHEL 8 container images have been. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat build of Cryostat 2.3.0: new RHEL 8 container images Advisory ID: RHSA-2023:3167-01 Product: Cryostat Advisory URL: https://access.redhat.com/errata/RHSA-2023:3167 Issue date: 2023-05-18 CVE Names: CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 ==================================================================== 1. Summary: New Red Hat build of Cryostat 2.3.0 on RHEL 8 container images are now available 2. Description: New Red Hat build of Cryostat 2.3.0 on RHEL 8 container images have been released, adding a variety of features and bug fixes. Users of the Red Hat build of Cryostat 2.2.1 on RHEL 8 container images are advised to upgrade to these updated images, which contain backported patches to fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images. You can find images updated by this advisory in Red Hat Container Catalog (see References). 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding 2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption 2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics 2184482 - CVE-2023-24536 golang: net/http,net/textproto, mime/multipart: denial of service from excessive resource consumption 2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation 2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing 5. References: https://access.redhat.com/security/cve/CVE-2022-41723 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/updates/classification#moderate https://catalog.redhat.com/en 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZGa7WNzjgjWX9erEAQj+FBAAnOGWrSlLKpNzsqaUosxtnFWSj0XhGrMf ajUNhtopUI4eJTEuJee/5toBKuyYGriJQ0R+CcmBd7XaZekjAEtjdC3ncglQb1Ew soEb9WrzoTcuVnPTJlJfY65am+zZRmc19L+S47ZYh3rr7kr50vadbFHb9IEE0p3F 5Ikh3BAFHfQ3SIrsIiQjCGW1cS6vUB3YDpTj/k70Jya80VKDSfBq15+YUrBUlwWb 2uXxrZ+h6Wm+njM8Sk+tGGitWI9zZiLGdnoor5iaOFZ6z7nQeUE1fC/CFH1chPat CXBiD3HeMfUD65EuzDwnz7VR8lNihDzJByA649z2BiJRC0OoO7UlukZLbVcqiyFU p1TKBqI5ysUP9CN/M68mcKojkXQj0Lsx92TnYjdol3i+3kXEetXITxRwk54o/JoZ UbJpq2VlIbfoGitvFBnfT2wOV/E0M9GfF/EhL6nOd53Gp1A8WRpkCzLmNnL14/yC MMQ8zHRolEQiUXOMxGta+H85OBrlu3JugprOBxQBtIj/awHYTVBtWW1CFn/dhA00 qo3oH4T16bKVe7Bn8NvDDo7B5AjIu7yZJQ/kDGJH/hdULVS6qYINbFdZRePGivuK K8uAmcaFBu4CqTsmYNWF5EbUoPRojYmPykQ4tFLVJHncnSb5+w28Wuy7aQuBu3Zo 1w86mzSGkvw=XKpE -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Get the latest Linux and open source security news straight to your inbox.