Lucene search

K
osvGoogleOSV:ALSA-2023:0208
HistoryJan 26, 2023 - 12:00 a.m.

Moderate: java-1.8.0-openjdk security and bug fix update

2023-01-2600:00:00
Google
osv.dev
8
openjdk
security fix
bug fix
corba deserialization
soundbank url
cvss score
file descriptors
resolverlocalfilesystem
quarterly release
solr access denied.

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.9%

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

  • OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830)
  • OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Leak File Descriptors Because of ResolverLocalFilesystem#engineResolveURI() (BZ#2139705)
  • Prepare for the next quarterly OpenJDK upstream release (2023-01, 8u362) [almalinux-8] (BZ#2159910)
  • solr broken due to access denied (“java.io.FilePermission” “/etc/pki/java/cacerts” “read”) [almalinux-8, openjdk-8] (BZ#2163595)

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.9%