CVE-2023-22067

The OpenJDK runtime environment 8.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2023-22067)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2023-22081)

The OpenJDK runtime environment 8.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2023-22067)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2023-22081)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

• OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433)
• OpenJDK: IOR deserialization issue in CORBA (8303384) (CVE-2023-22067)
• OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 8u382 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 8u392, increases it to 16 MB. (AlmaLinux-13635)
• The /usr/bin/jfr alternative is now owned by the java-1.8.0-openjdk package (AlmaLinux-13641)

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

• OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433)
• OpenJDK: IOR deserialization issue in CORBA (8303384) (CVE-2023-22067)
• OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 8u382 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 8u392, increases it to 16 MB. (AlmaLinux-13593)
• The /usr/bin/jfr alternative is now owned by the java-1.8.0-openjdk package (AlmaLinux-13583)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

• Backport upstream releases 8u392 to 18.04 LTS
• CVEs fixed in 8u392:
  • CVE-2023-22067: IOR deserialization issue in CORBA
  • CVE-2023-22081: Certificate path validation issue
• CVEs fixed in 8u382:
  • CVE-2023-22045: OpenJDK incorrectly handled array accesses.
  • CVE-2023-22049: OpenJDK incorrectly sanitized URIs strings.
• Drop applied CVE-2022-40433.patch (changes are already in the sources)

• Backport upstream releases 8u392 to 16.04 LTS
• CVEs fixed in 8u392:
  • CVE-2023-22067: IOR deserialization issue in CORBA
  • CVE-2023-22081: Certificate path validation issue
• Drop applied CVE-2022-40433.patch (changes are already in the sources)

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06. That fixes following CVEs:
• CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler
• CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution
• CVE-2024-20921: Range check loop optimization issue
• CVE-2024-20926: Arbitrary Java code execution in Nashorn
• CVE-2024-20945: Logging of digital signature private keys
• CVE-2024-20952: RSA padding issue and timing side-channel attack against TLS
• CVE-2023-22067: IOR deserialization issue in CORBA (fixed in jdk8u392)
• CVE-2023-22081: Certificate path validation issue during client authentication (fixed in jdk8u392)
• Adapt pr2462 patch to the new sources

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06. That fixes following CVEs:
• CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler
• CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution
• CVE-2024-20921: Range check loop optimization issue
• CVE-2024-20926: Arbitrary Java code execution in Nashorn
• CVE-2024-20945: Logging of digital signature private keys
• CVE-2024-20952: RSA padding issue and timing side-channel attack against TLS
• CVE-2023-22067: IOR deserialization issue in CORBA (fixed in jdk8u392)
• CVE-2023-22081: Certificate path validation issue during client authentication (fixed in jdk8u392)
• Adapt pr2462 patch to the new sources

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06. That fixes following CVEs:
• CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler
• CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution
• CVE-2024-20921: Range check loop optimization issue
• CVE-2024-20926: Arbitrary Java code execution in Nashorn
• CVE-2024-20945: Logging of digital signature private keys
• CVE-2024-20952: RSA padding issue and timing side-channel attack against TLS
• CVE-2023-22067: IOR deserialization issue in CORBA (fixed in jdk8u392)
• CVE-2023-22081: Certificate path validation issue during client authentication (fixed in jdk8u392)
• Adapt pr2462 patch to the new sources

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06. That fixes following CVEs:
• CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler
• CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution
• CVE-2024-20921: Range check loop optimization issue
• CVE-2024-20926: Arbitrary Java code execution in Nashorn
• CVE-2024-20945: Logging of digital signature private keys
• CVE-2024-20952: RSA padding issue and timing side-channel attack against TLS
• CVE-2023-22067: IOR deserialization issue in CORBA (fixed in jdk8u392)
• CVE-2023-22081: Certificate path validation issue during client authentication (fixed in jdk8u392)
• Adapt pr2462 patch to the new sources

The updated packages fix security vulnerabilities:

Segmentation fault in ciMethodBlocks. (CVE-2022-40433)

Certificate path validation issue during client authentication. (CVE-2023-22081)

IOR deserialization issue in CORBA. (CVE-2023-22067)

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.392-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openj9-1.8.0.392-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-1_8_0-openjdk fixes the following issues:

Update to version jdk8u392 (icedtea-3.29.0) October 2023 CPU:

• CVE-2023-22067: Fixed IOR deserialization issue in CORBA (bsc#1216379).
• CVE-2023-22081: Fixed certificate path validation issue during client authentication (bsc#1216374).
• CVE-2015-4000: Fixed Logjam issue in SLES12SP5 (bsc#1211968).

This update for java-1_8_0-openjdk fixes the following issues:

Update to version jdk8u392 (icedtea-3.29.0) October 2023 CPU:

• CVE-2023-22067: Fixed IOR deserialization issue in CORBA (bsc#1216379).
• CVE-2023-22081: Fixed certificate path validation issue during client authentication (bsc#1216374).
• CVE-2015-4000: Fixed Logjam issue in SLES12SP5 (bsc#1211968).

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 8 Fix Pack 15:
  • Oracle October 17 2023 CPU [bsc#1216640]

Security fixes:

• CVE-2023-22081: Fixed enhanced TLS connections (bsc#1216374)
• CVE-2023-22067: Fixed IOR deserialization issue in CORBA (bsc#1216379)
• CVE-2023-22025: Fixed memory corruption issue on x86_64 with AVX-512 (bsc#1216339)
• CVE-2023-5676: Fixed receiving a signal before initialization may lead to an infinite loop or unexpected crash (bsc#1217214)

Bug fixes:

• IBM Java idlj compiler switch definition because IBM java idlj seems to confuse char and wchar for typedef types (bsc#1204264).

This update for java-1_8_0-openj9 fixes the following issues:

Update to OpenJDK 8u392 build 08 with OpenJ9 0.41.0 virtual machine

• CVE-2023-22067: Fixed an IOR deserialization issue in CORBA (bsc#1216379).
• CVE-2023-22081: Fixed a certificate path validation issue during client authentication (bsc#1216374).
• CVE-2023-5676: Fixed receiving a signal before initialization may lead to an infinite loop or unexpected crash (bsc#1217214).

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 8 Fix Pack 15:
  • Oracle October 17 2023 CPU [bsc#1216640]

Security fixes:

• CVE-2023-22081: Fixed enhanced TLS connections (bsc#1216374)
• CVE-2023-22067: Fixed IOR deserialization issue in CORBA (bsc#1216379)
• CVE-2023-22025: Fixed memory corruption issue on x86_64 with AVX-512 (bsc#1216339)
• CVE-2023-5676: Fixed receiving a signal before initialization may lead to an infinite loop or unexpected crash (bsc#1217214)

Bug fixes:

• IBM Java idlj compiler switch definition because IBM java idlj seems to confuse char and wchar for typedef types (bsc#1204264).

It was discovered that the HotSpot VM implementation in OpenJDK did not properly validate bytecode blocks in certain situations. An attacker could possibly use this to cause a denial of service. (CVE-2022-40433)

Carter Kozak discovered that OpenJDK, when compiling with AVX-512 instruction support enabled, could produce code that resulted in memory corruption in certain situations. An attacker targeting applications built in this way could possibly use this to cause a denial of service or execute arbitrary code. In Ubuntu, OpenJDK defaults to not using AVX-512 instructions. (CVE-2023-22025)

It was discovered that the CORBA implementation in OpenJDK did not properly perform deserialization of IOR string objects. An attacker could possibly use this to bypass Java sandbox restrictions. (CVE-2023-22067)

It was discovered that OpenJDK did not properly perform PKIX certification path validation in certain situations. An attacker could use this to cause a denial of service. (CVE-2023-22081)