ALAS2-2023-1919 — Moderate: java-17-amazon-corretto security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21843: Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21835: Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS.

Fixed packages 5

Release	Package	Fixed in
Amazon Linux · 2	java-17-amazon-corretto	1:17.0.6+10-1.amzn2.1
Amazon Linux · 2	java-17-amazon-corretto-devel	1:17.0.6+10-1.amzn2.1
Amazon Linux · 2	java-17-amazon-corretto-headless	1:17.0.6+10-1.amzn2.1
Amazon Linux · 2	java-17-amazon-corretto-javadoc	1:17.0.6+10-1.amzn2.1
Amazon Linux · 2	java-17-amazon-corretto-jmods	1:17.0.6+10-1.amzn2.1

Vulnerabilities 2

Medium 5.3

CVE-2023-21835

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Sup…

Oracle Java SE JDK and JRE openjdk-lts openjdk-9 Debian Ubuntu Alpine Wolfi

Jan 17, 2023
Low 3.7

CVE-2023-21843

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Su…

Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi

Jan 17, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-21835.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-21843.html

Moderate: java-17-amazon-corretto security update (Amazon Linux 2)

Summary

Fixed packages 5

Vulnerabilities 2

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Sup…

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Su…

References