Updated java packages fix security vulnerabilities

2023-09-3022:15:40

Gentoo Foundation

advisories.mageia.org

java

packages

security

vulnerabilities

file conflict

tls handshake

garbage collector

certificate validation

swing

html parsing

processbuilder

uri-to-path conversion

array indexing

http client

zip file parsing

aes implementation

unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

68.2%

JSON

The updated packages fix security vulnerabilities and a file conflict : Improper connection handling during TLS handshake. (CVE-2023-21930) Incorrect enqueue of references in garbage collector. (CVE-2023-21954) Certificate validation issue in TLS session negotiation. (CVE-2023-21967) Swing HTML parsing issue. (CVE-2023-21939) Incorrect handling of NULL characters in ProcessBuilder. (CVE-2023-21938) Missing string checks for NULL characters. (CVE-2023-21937) Missing check for slash characters in URI-to-path conversion. (CVE-2023-21968) Array indexing integer overflow issue. (CVE-2023-22045) Improper handling of slash characters in URI-to-path conversion. (CVE-2023-22049) O(n^2) growth via consecutive marks. (CVE-2023-25193) HTTP client insufficient file name validation. (CVE-2023-22006) ZIP file parsing infinite loop. (CVE-2023-22036) Modulo operator array indexing issue. (CVE-2023-22044) Weakness in AES implementation. (CVE-2023-22041)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchjava< 1.8.0-openjdk-1.8.0.382.b05-1java-1.8.0-openjdk-1.8.0.382.b05-1.mga8
Mageia8noarchjava< 11-openjdk-11.0.20.0.8-1java-11-openjdk-11.0.20.0.8-1.mga8
Mageia8noarchopenjfx< 11.0.9.2-4openjfx-11.0.9.2-4.mga8
Mageia9noarchjava< 1.8.0-openjdk-1.8.0.382.b05-1java-1.8.0-openjdk-1.8.0.382.b05-1.mga9
Mageia9noarchjava< 11-openjdk-11.0.20.0.8-1java-11-openjdk-11.0.20.0.8-1.mga9
Mageia9noarchjava< 17-openjdk-17.0.8.0.7-1java-17-openjdk-17.0.8.0.7-1.mga9
Mageia9noarchjava-latest-openjdk< 20.0.2.0.9-1.rolling.2java-latest-openjdk-20.0.2.0.9-1.rolling.2.mga9

OS	Version	Architecture	Package	Version	Filename
Mageia	8	noarch	java	< 1.8.0-openjdk-1.8.0.382.b05-1	java-1.8.0-openjdk-1.8.0.382.b05-1.mga8
Mageia	8	noarch	java	< 11-openjdk-11.0.20.0.8-1	java-11-openjdk-11.0.20.0.8-1.mga8
Mageia	8	noarch	openjfx	< 11.0.9.2-4	openjfx-11.0.9.2-4.mga8
Mageia	9	noarch	java	< 1.8.0-openjdk-1.8.0.382.b05-1	java-1.8.0-openjdk-1.8.0.382.b05-1.mga9
Mageia	9	noarch	java	< 11-openjdk-11.0.20.0.8-1	java-11-openjdk-11.0.20.0.8-1.mga9
Mageia	9	noarch	java	< 17-openjdk-17.0.8.0.7-1	java-17-openjdk-17.0.8.0.7-1.mga9
Mageia	9	noarch	java-latest-openjdk	< 20.0.2.0.9-1.rolling.2	java-latest-openjdk-20.0.2.0.9-1.rolling.2.mga9