Summary
It was discovered that OpenJDK incorrectly verified Jar signatures. An
attacker could possibly use this issue to bypass intended security
restrictions when using Jar files signed with a disabled algorithm.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | openjdk-8 | 8u292-b10-0ubuntu1~16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | openjdk-8 | 8u292-b10-0ubuntu1~18.04 |
| Ubuntu · 18.04 LTS 18.04:LTS | openjdk-lts | 11.0.11+9-0ubuntu2~18.04 |
| Ubuntu · 20.04 LTS 20.04:LTS | openjdk-8 | 8u292-b10-0ubuntu1~20.04 |
| Ubuntu · 20.04 LTS 20.04:LTS | openjdk-lts | 11.0.11+9-0ubuntu2~20.04 |
Vulnerabilities 1
-
Medium 5.3
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:…
References
-
report
https://ubuntu.com/security/CVE-2021-2163