CVE-2022-21540

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

The OpenJDK runtime environment 8.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21349)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2022-21540)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2022-21541)

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include…

The OpenJDK runtime environment.

Security Fix(es):

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.(CVE-2022-34169)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2022-21541)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2022-21540)

The OpenJDK runtime environment.

Security Fix(es):

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.(CVE-2022-34169)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2022-21541)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2022-21540)

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8). (BZ#2084649)

Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [Rocky Linux-8, openjdk-11] (BZ#2099917)

• Revert to disabling system security properties and FIPS mode support together [Rocky Linux-8, openjdk-11] (BZ#2108248)

• SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [Rocky Linux-8, openjdk-11] (BZ#2108251)

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07). (BZ#2084648)

Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [Rocky Linux-8, openjdk-8] (BZ#2099911)

• Revert to disabling system security properties and FIPS mode support together [Rocky Linux-8, openjdk-8] (BZ#2108564)

• SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [Rocky Linux-8, openjdk-8] (BZ#2108566)

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

The following packages have been upgraded to a later upstream version: java-17-openjdk (17.0.4.0.8). (BZ#2084650)

Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

• OpenJDK: random exponentials issue (Libraries, 8283875) (CVE-2022-21549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Previous Rocky Enterprise Software Foundation builds of OpenJDK 17 altered the arguments passed to sun.security.pkcs11.wrapper.PKCS11.getInstance() in order to facilitate FIPS support. This build adds an additional form of the method, retaining the original arguments, so that applications which depend on this internal method continue to function with Rocky Enterprise Software Foundation builds of OpenJDK. (BZ#2099913)

• With previous Rocky Enterprise Software Foundation builds of OpenJDK 17, Mac key generation and import would fail due to the lack of the CKA_SIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration. (BZ#2108190)

• With the release of Rocky Linux 8.6, a change was made so that disabling OpenJDK FIPS mode required the use of both the -Djava.security.disableSystemPropertiesFile=true and -Dcom.redhat.fips=false options, with the intention that FIPS mode could be controlled independently of system security properties. This change has now been reverted and only -Djava.security.disableSystemPropertiesFile=true is required to disable FIPS mode, as in Rocky Linux 8.4. (BZ#2108206)

• Previous Rocky Enterprise Software Foundation builds of OpenJDK 17 running in FIPS mode with a SecurityManager would fail due to a lack of module access permissions. This has now been corrected. (BZ#2108209)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8). (BZ#2084649) Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-8, openjdk-11] (BZ#2099917)
• Revert to disabling system security properties and FIPS mode support together [almalinux-8, openjdk-11] (BZ#2108248)
• SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-8, openjdk-11] (BZ#2108251)

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8). (BZ#2084777) Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-9, openjdk-11] (BZ#2099915)
• SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-9, openjdk-11] (BZ#2107866)
• Revert to disabling system security properties and FIPS mode support together [almalinux-9, openjdk-11] (BZ#2107868)

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07). (BZ#2084648) Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-8, openjdk-8] (BZ#2099911)
• Revert to disabling system security properties and FIPS mode support together [almalinux-8, openjdk-8] (BZ#2108564)
• SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-8, openjdk-8] (BZ#2108566)

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07). (BZ#2084776) Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-9, openjdk-8] (BZ#2099916)
• SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-9, openjdk-8] (BZ#2107956)
• Revert to disabling system security properties and FIPS mode support together [almalinux-9, openjdk-8] (BZ#2107958)

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-17-openjdk (17.0.4.0.8). (BZ#2084779) Security Fix(es):

• OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
• OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
• OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)
• OpenJDK: random exponentials issue (Libraries, 8283875) (CVE-2022-21549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• Previous AlmaLinux builds of OpenJDK 17 altered the arguments passed to sun.security.pkcs11.wrapper.PKCS11.getInstance() in order to facilitate FIPS support. This build adds an additional form of the method, retaining the original arguments, so that applications which depend on this internal method continue to function with AlmaLinux builds of OpenJDK. (BZ#2099919)
• With previous AlmaLinux builds of OpenJDK 17, Mac key generation and import would fail due to the lack of the CKA_SIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration. (BZ#2105395)
• With the release of AlmaLinux, a change was made so that disabling OpenJDK FIPS mode required the use of both the -Djava.security.disableSystemPropertiesFile=true and -Dcom.AlmaLinux.fips=false options, with the intention that FIPS mode could be controlled independently of system security properties. This change has now been reverted and only -Djava.security.disableSystemPropertiesFile=true is required to disable FIPS mode, as in AlmaLinux. (BZ#2107941)
• Previous AlmaLinux builds of OpenJDK 17 running in FIPS mode with a SecurityManager would fail due to a lack of module access permissions. This has now been corrected. (BZ#2107943)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u342-b07. That fixes following CVEs:
• CVE-2022-34169: Integer truncation issue in Xalan-J
• CVE-2022-21540: Class compilation issue
• CVE-2022-21541: Improper restriction of MethodHandle.invokeBasic()
• Update tzdata requirement to 2022a to match JDK-8283350
• Remove patch for MakeBase.gmk cause issue was fixed in sources
• Correct parameters passing to CheckVendor test

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u342-b07. That fixes following CVEs:
• CVE-2022-34169: Integer truncation issue in Xalan-J
• CVE-2022-21540: Class compilation issue
• CVE-2022-21541: Improper restriction of MethodHandle.invokeBasic()
• Update tzdata requirement to 2022a to match JDK-8283350
• Remove patch for MakeBase.gmk cause issue was fixed in sources
• Correct parameters passing to CheckVendor test

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u342-b07. That fixes following CVEs:
• CVE-2022-34169: Integer truncation issue in Xalan-J
• CVE-2022-21540: Class compilation issue
• CVE-2022-21541: Improper restriction of MethodHandle.invokeBasic()
• Update tzdata requirement to 2022a to match JDK-8283350
• Remove patch for MakeBase.gmk cause issue was fixed in sources
• Correct parameters passing to CheckVendor test

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u342-b07. That fixes following CVEs:
• CVE-2022-34169: Integer truncation issue in Xalan-J
• CVE-2022-21540: Class compilation issue
• CVE-2022-21541: Improper restriction of MethodHandle.invokeBasic()
• Update tzdata requirement to 2022a to match JDK-8283350
• Remove patch for MakeBase.gmk cause issue was fixed in sources
• Correct parameters passing to CheckVendor test

• Backport upstream releases 8u342 and 8u332 to 16.04 LTS
• Security fixes in 8u342:
  • JDK-8272243: Improve DER parsing
  • JDK-8272249: Better properties of loaded Properties
  • JDK-8277608: Address IP Addressing
  • JDK-8281859, CVE-2022-21540: Improve class compilation
  • JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
  • JDK-8283190: Improve MIDI processing
  • JDK-8284370: Improve zlib usage
  • JDK-8285407, CVE-2022-34169: Improve Xalan supports
• Security fixes in 8u332:
  • JDK-8269938: Enhance XML processing passes redux
  • JDK-8270504, CVE-2022-21426: Better XPath expression handling
  • JDK-8272255: Completely handle MIDI files
  • JDK-8272261: Improve JFR recording file processing
  • JDK-8272594: Better record of recordings
  • JDK-8274221: More definite BER encodings
  • JDK-8275151, CVE-2022-21443: Improved Object Identification
  • JDK-8277227: Better identification of OIDs
  • JDK-8277672, CVE-2022-21434: Better invocation handler handling
  • JDK-8278008, CVE-2022-21476: Improve Santuario processing
  • JDK-8278356: Improve file creation
  • JDK-8278449: Improve keychain support
  • JDK-8278805: Enhance BMP image loading
  • JDK-8278972, CVE-2022-21496: Improve URL supports
  • JDK-8281388: Change wrapping of EncryptedPrivateKeyInfo

• Bump to 2.6.28 and OpenJDK 7u351-b01.
• Security fixes in 7u351:
• CVE-2022-21540: Improve class compilation (JDK-8281859)
• CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
• CVE-2022-34169: Improve Xalan supports (JDK-8285407)
• Security fixes in 7u341:
• CVE-2022-21426: Better XPath expression handling (JDK-8270504)
• CVE-2022-21434: Better invocation handler handling (JDK-8277672)
• CVE-2022-21443: Improved Object Identification (JDK-8275151)
• CVE-2022-21476: Improve Santuario processing (JDK-8278008)
• CVE-2022-21496: Improve URL supports (JDK-8278972)
• Security fixes in 7u331:
• CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
• CVE-2022-21282: Better resolution of URIs (JDK-8270492)
• CVE-2022-21283: Better String matching (JDK-8268813)
• CVE-2022-21293: Improve String constructions (JDK-8270392)
• CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
• CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
• CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
• CVE-2022-21305: Better array indexing (JDK-8272014)
• CVE-2022-21340: Verify Jar Verification (JDK-8272026)
• CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
• CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
• CVE-2022-21360: Enhance BMP image support (JDK-8273756)
• CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
• Security fixes in 7u321:
• CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
• CVE-2021-35556: Richer Text Editors (JDK-8265167)
• CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
• CVE-2021-35561: Better hashing support (JDK-8266097)
• CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
• CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
• CVE-2021-35586: Better BMP support (JDK-8267735)
• CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
• CVE-2021-35603: Better session identification (JDK-8269618)
• Security fixes in 7u311:
• CVE-2021-2341: Improve file transfers (JDK-8258432)
• CVE-2021-2369: Better jar file validation (JDK-8260967)
• CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
• Security fixes in 7u301:
• CVE-2021-2161: Less ambiguous processing (JDK-8250568)
• CVE-2021-2163: Enhance opening JARs (JDK-8249906)
• Security fixes in 7u281:
• CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
• CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
• CVE-2020-14782: Enhance certificate processing (JDK-8237995)
• CVE-2020-14792: Better range handling (JDK-8241114)
• CVE-2020-14796: Improved URI Support (JDK-8242680)
• CVE-2020-14797: Better Path Validation (JDK-8242685)
• CVE-2020-14798: Enhanced buffer support (JDK-8242695)
• CVE-2020-14803: Improved Buffer supports (JDK-8244136)
• Security fixes in 7u271:
• CVE-2020-14577: Enhance certificate verification (JDK-8237592)
• CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
• CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
• CVE-2020-14581: Better matrix operations (JDK-8238002)
• CVE-2020-14583: Better Buffer support (JDK-8238920)
• CVE-2020-14593: Less Affine Transformations (JDK-8240119)
• CVE-2020-14621: Better XML namespace handling (JDK-8242136)
• Update tzdata requirement to 2022a to match JDK-8283350
• Update NEWS from IcedTea
• Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version

• Bump to 2.6.28 and OpenJDK 7u351-b01.
• Security fixes in 7u351:
• CVE-2022-21540: Improve class compilation (JDK-8281859)
• CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
• CVE-2022-34169: Improve Xalan supports (JDK-8285407)
• Security fixes in 7u341:
• CVE-2022-21426: Better XPath expression handling (JDK-8270504)
• CVE-2022-21434: Better invocation handler handling (JDK-8277672)
• CVE-2022-21443: Improved Object Identification (JDK-8275151)
• CVE-2022-21476: Improve Santuario processing (JDK-8278008)
• CVE-2022-21496: Improve URL supports (JDK-8278972)
• Security fixes in 7u331:
• CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
• CVE-2022-21282: Better resolution of URIs (JDK-8270492)
• CVE-2022-21283: Better String matching (JDK-8268813)
• CVE-2022-21293: Improve String constructions (JDK-8270392)
• CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
• CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
• CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
• CVE-2022-21305: Better array indexing (JDK-8272014)
• CVE-2022-21340: Verify Jar Verification (JDK-8272026)
• CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
• CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
• CVE-2022-21360: Enhance BMP image support (JDK-8273756)
• CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
• Security fixes in 7u321:
• CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
• CVE-2021-35556: Richer Text Editors (JDK-8265167)
• CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
• CVE-2021-35561: Better hashing support (JDK-8266097)
• CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
• CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
• CVE-2021-35586: Better BMP support (JDK-8267735)
• CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
• CVE-2021-35603: Better session identification (JDK-8269618)
• Security fixes in 7u311:
• CVE-2021-2341: Improve file transfers (JDK-8258432)
• CVE-2021-2369: Better jar file validation (JDK-8260967)
• CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
• Security fixes in 7u301:
• CVE-2021-2161: Less ambiguous processing (JDK-8250568)
• CVE-2021-2163: Enhance opening JARs (JDK-8249906)
• Security fixes in 7u281:
• CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
• CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
• CVE-2020-14782: Enhance certificate processing (JDK-8237995)
• CVE-2020-14792: Better range handling (JDK-8241114)
• CVE-2020-14796: Improved URI Support (JDK-8242680)
• CVE-2020-14797: Better Path Validation (JDK-8242685)
• CVE-2020-14798: Enhanced buffer support (JDK-8242695)
• CVE-2020-14803: Improved Buffer supports (JDK-8244136)
• Security fixes in 7u271:
• CVE-2020-14577: Enhance certificate verification (JDK-8237592)
• CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
• CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
• CVE-2020-14581: Better matrix operations (JDK-8238002)
• CVE-2020-14583: Better Buffer support (JDK-8238920)
• CVE-2020-14593: Less Affine Transformations (JDK-8240119)
• CVE-2020-14621: Better XML namespace handling (JDK-8242136)
• Update tzdata requirement to 2022a to match JDK-8283350
• Update NEWS from IcedTea
• Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version

Class compilation issue. (CVE-2022-21540) Improper restriction of MethodHandle.invokeBasic(). (CVE-2022-21541) Integer truncation issue in Xalan-J. (CVE-2022-34169) Improper MultiByte conversion can lead to buffer overflow. (CVE-2022-21618) Improper handling of long NTLM client hostnames. (CVE-2022-21619) Insufficient randomization of JNDI DNS port numbers. (CVE-2022-21624) Excessive memory allocation in X.509 certificate parsing. (CVE-2022-21626) HttpServer no connection count limit. (CVE-2022-21628) Missing SNI caching in HTTP/2. (CVE-2022-39399)

These are all security issues fixed in the java-13-openjdk-13.0.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-15-openjdk-15.0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-18-openjdk-18.0.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openjdk-11.0.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openjdk-17.0.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.345-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openj9-11.0.16.0-1.1 package on the GA media of openSUSE Tumbleweed.