Summary
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07). (BZ#2084648)
Security Fix(es):
* OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
* OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
* OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-8, openjdk-8] (BZ#2099911)
* Revert to disabling system security properties and FIPS mode support together [almalinux-8, openjdk-8] (BZ#2108564)
* SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-8, openjdk-8] (BZ#2108566)
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | java-1.8.0-openjdk | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-accessibility | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-accessibility-fastdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-accessibility-slowdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-demo | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-demo-fastdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-demo-slowdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-devel | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-devel-fastdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-devel-slowdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-fastdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-headless | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-headless-fastdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-headless-slowdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-javadoc | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-javadoc-zip | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-slowdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-src | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-src-fastdebug | 1:1.8.0.342.b07-2.el8_6 |
| AlmaLinux · 8 | java-1.8.0-openjdk-src-slowdebug | 1:1.8.0.342.b07-2.el8_6 |
Vulnerabilities 3
-
High 7.5
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
References
-
report
https://access.redhat.com/security/cve/CVE-2022-21540
-
report
https://access.redhat.com/security/cve/CVE-2022-21541
-
report
https://access.redhat.com/security/cve/CVE-2022-34169
-
report
https://bugzilla.redhat.com/2108540
-
report
https://bugzilla.redhat.com/2108543
-
report
https://bugzilla.redhat.com/2108554
-
advisory
https://errata.almalinux.org/8/ALSA-2022-5696.html