Skip to content
OpenAdvisories
High ELSA-2025-10873 4 CVEs

Important: java-21-openjdk security update (Oracle Linux 8)

Published Jul 29, 2025 · Updated Jul 29, 2025

Summary

[1:21.0.8.0.9-1.0.1]
- Add Oracle vendor bug URL [Orabug: 34340155]

[1:21.0.8.0.9-1.1]
- Update to jdk-21.0.8+9 (GA)
- Update release notes to 21.0.8+9
- Switch to GA mode
- Sync the copy of the portable specfile with the latest update
- ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
- Resolves: RHEL-102278

[1:21.0.8.0.8-0.1.ea]
- Update to jdk-21.0.8+8 (EA)
- Update release notes to 21.0.8+8
- Sync the copy of the portable specfile with the latest update
- Resolves: RHEL-101799

[1:21.0.8.0.2-0.1.ea]
- Update to jdk-21.0.8+2 (EA)
- Update release notes to 21.0.8+2
- Sync the copy of the portable specfile with the latest update
- Add timezone data update check to openjdk_news.sh
- Add duplicate check to openjdk_news.sh
- Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
- Related: RHEL-101799
- Resolves: RHEL-103210

[1:21.0.8.0.1-0.1.ea]
- Update get_bundle_versions.sh to match other scripts
- * get_bundle_versions.sh: Add license
- * get_bundle_versions.sh: Set compile-command in Emacs
- * get_bundle_versions.sh: Use different error codes for different failures
- * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
- * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
- * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
- Add OpenJDK 8u support to get_bundle_versions.sh
- Print bundle updates and backouts at end of openjdk_news.sh output
- Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
- Related: RHEL-103210

[1:21.0.8.0.1-0.1.ea]
- Add script to obtain bundled library versions from OpenJDK sources
- Related: RHEL-103210

[1:21.0.8.0.1-0.1.ea]
- Warn about bundled provide version bumps and backouts in openjdk_news.sh
- Related: RHEL-103210

[1:21.0.8.0.1-0.1.ea]
- Update to jdk-21.0.8+1 (EA)
- Update release notes to 21.0.8+1
- Bump freetype version to 2.13.3 following JDK-8348596
- Bump harfbuzz version to 10.4.0 following JDK-8348597
- Bump lcms2 version to 2.17.0 following JDK-8348110
- Bump libpng version to 1.6.47 following JDK-8348598
- Switch to EA mode
- Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream
- Sync the copy of the portable specfile with the latest update
- Related: RHEL-101799

Fixed packages 23

ReleasePackageFixed in
Oracle Linux · 8 java-21-openjdk 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-demo 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-demo-fastdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-demo-slowdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-devel 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-devel-fastdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-devel-slowdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-fastdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-headless 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-headless-fastdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-headless-slowdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-javadoc 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-javadoc-zip 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-jmods 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-jmods-fastdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-jmods-slowdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-slowdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-src 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-src-fastdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-src-slowdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-static-libs 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-static-libs-fastdebug 1:21.0.8.0.9-1.0.1.el10
Oracle Linux · 8 java-21-openjdk-static-libs-slowdebug 1:21.0.8.0.9-1.0.1.el10

Vulnerabilities 4