Skip to content
OpenAdvisories
High USN-6077-1 7 CVEs

openjdk-8, openjdk-lts, openjdk-17, openjdk-20 vulnerabilities

Published May 16, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Ben Smyth discovered that OpenJDK incorrectly handled half-duplex
connections during TLS handshake. A remote attacker could possibly use
this issue to insert, edit or obtain sensitive information.
(CVE-2023-21930)

It was discovered that OpenJDK incorrectly handled certain inputs. An
attacker could possibly use this issue to insert, edit or obtain sensitive
information. (CVE-2023-21937)

It was discovered that OpenJDK incorrectly handled command arguments. An
attacker could possibly use this issue to insert, edit or obtain sensitive
information. (CVE-2023-21938)

It was discovered that OpenJDK incorrectly validated HTML documents. An
attacker could possibly use this issue to insert, edit or obtain sensitive
information. (CVE-2023-21939)

Ramki Ramakrishna discovered that OpenJDK incorrectly handled garbage
collection. An attacker could possibly use this issue to bypass Java
sandbox restrictions. (CVE-2023-21954)

Jonathan Looney discovered that OpenJDK incorrectly handled certificate
chains during TLS session negotiation. A remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-21967)

Adam Reziouk discovered that OpenJDK incorrectly sanitized URIs. An
attacker could possibly use this issue to bypass Java sandbox
restrictions. (CVE-2023-21968)

Fixed packages 10

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS openjdk-17 17.0.7+7~us1-0ubuntu1~18.04
Ubuntu · 18.04 LTS 18.04:LTS openjdk-8 8u372-ga~us1-0ubuntu1~18.04
Ubuntu · 18.04 LTS 18.04:LTS openjdk-lts 11.0.19+7~us1-0ubuntu1~18.04.1
Ubuntu · 20.04 LTS 20.04:LTS openjdk-17 17.0.7+7~us1-0ubuntu1~20.04
Ubuntu · 20.04 LTS 20.04:LTS openjdk-8 8u372-ga~us1-0ubuntu1~20.04
Ubuntu · 20.04 LTS 20.04:LTS openjdk-lts 11.0.19+7~us1-0ubuntu1~20.04.1
Ubuntu · 22.04 LTS 22.04:LTS openjdk-17 17.0.7+7~us1-0ubuntu1~22.04.2
Ubuntu · 22.04 LTS 22.04:LTS openjdk-8 8u372-ga~us1-0ubuntu1~22.04
Ubuntu · 22.04 LTS 22.04:LTS openjdk-lts 11.0.19+7~us1-0ubuntu1~22.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS openjdk-8 8u372-ga~us1-0ubuntu1~16.04

Vulnerabilities 7

References

  • report
    https://ubuntu.com/security/CVE-2023-21930
  • report
    https://ubuntu.com/security/CVE-2023-21937
  • report
    https://ubuntu.com/security/CVE-2023-21938
  • report
    https://ubuntu.com/security/CVE-2023-21939
  • report
    https://ubuntu.com/security/CVE-2023-21954
  • report
    https://ubuntu.com/security/CVE-2023-21967
  • report
    https://ubuntu.com/security/CVE-2023-21968