Moderate: java-1.8.0-openjdk security update

2023-10-1800:00:00

Google

osv.dev

openjdk

security update

segmentation fault

deserialization issue

certificate path validation

8u392

jdk.jar.maxsignaturefilesize

jfr alternative ownership

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.6%

JSON

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433)
OpenJDK: IOR deserialization issue in CORBA (8303384) (CVE-2023-22067)
OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 8u382 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 8u392, increases it to 16 MB. (AlmaLinux-13593)
The /usr/bin/jfr alternative is now owned by the java-1.8.0-openjdk package (AlmaLinux-13583)