Skip to content
OpenAdvisories
Medium USN-6527-1 2 CVEs

openjdk-17, openjdk-21, openjdk-lts vulnerabilities

Published Nov 29, 2023 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Carter Kozak discovered that OpenJDK, when compiling with AVX-512
instruction support enabled, could produce code that resulted in memory
corruption in certain situations. An attacker targeting applications built
in this way could possibly use this to cause a denial of service or execute
arbitrary code. In Ubuntu, OpenJDK defaults to not using AVX-512
instructions. (CVE-2023-22025)

It was discovered that OpenJDK did not properly perform PKIX certification
path validation in certain situations. An attacker could use this to cause
a denial of service. (CVE-2023-22081)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS openjdk-17 17.0.9+9-1~20.04
Ubuntu · 20.04 LTS 20.04:LTS openjdk-lts 11.0.21+9-0ubuntu1~20.04
Ubuntu · 22.04 LTS 22.04:LTS openjdk-17 17.0.9+9-1~22.04
Ubuntu · 22.04 LTS 22.04:LTS openjdk-lts 11.0.21+9-0ubuntu1~22.04
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS openjdk-17 17.0.9+9-1~18.04
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS openjdk-lts 11.0.21+9-0ubuntu1~18.04

Vulnerabilities 2

References

  • report
    https://ubuntu.com/security/CVE-2023-22025
  • report
    https://ubuntu.com/security/CVE-2023-22081