Important: GraalVM Security update (Oracle Linux 9)

Fixed packages 19

Vulnerabilities 5

• High 7.5
  CVE-2023-30589

  llhttp vulnerable to HTTP request smuggling

  The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…

  Node.js node openjdk17 nodejs Debian Azure Linux Alpine Wolfi npm
  Jun 30, 2023
• Medium 5.3
  CVE-2023-22067

  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Su…

  Oracle Java SE JDK and JRE openjdk-8 openjdk-9 Ubuntu Alpine Wolfi
  Oct 17, 2023
• Medium 5.3
  CVE-2023-22081

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Oct 17, 2023
• Unscored —
  CVE-2023-30588

  When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…

  Node.js node nodejs nodejs-20 Debian Wolfi
  Nov 28, 2023
• Unscored —
  CVE-2023-30590

  The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…

  Node.js node nodejs nodejs Debian Ubuntu Wolfi
  Nov 28, 2023