Summary
Juraj Somorovsky, Marcel Maehren, Nurullah Erinola, and Robert Merget
discovered that the DTLS implementation in the JSSE subsystem of OpenJDK
did not properly restrict handshake initiation requests from clients. A
remote attacker could possibly use this to cause a denial of service.
(CVE-2023-21835)
Markus Loewe discovered that the Java Sound subsystem in OpenJDK did not
properly validate the origin of a Soundbank. An attacker could use this to
specially craft an untrusted Java application or applet that could load a
Soundbank from an attacker controlled remote URL. (CVE-2023-21843)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | openjdk-17 | 17.0.6+10-0ubuntu1~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | openjdk-lts | 11.0.18+10-0ubuntu1~18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | openjdk-17 | 17.0.6+10-0ubuntu1~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | openjdk-lts | 11.0.18+10-0ubuntu1~20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | openjdk-17 | 17.0.6+10-0ubuntu1~22.04 |
| Ubuntu · 22.04 LTS 22.04:LTS | openjdk-19 | 19.0.2+7-0ubuntu3~22.04 |
| Ubuntu · 22.04 LTS 22.04:LTS | openjdk-lts | 11.0.18+10-0ubuntu1~22.04 |
Vulnerabilities 2
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Sup…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Su…