Security update for java-1_8_0-openjdk SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:1450-1 Final 1 1 2024-04-26T13:53:09Z current 2024-04-26T13:53:09Z 2024-04-26T13:53:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for java-1_8_0-openjdk This update for java-1_8_0-openjdk fixes the following issues: - CVE-2024-21011: Fixed denial of service due to long Exception message logging (JDK-8319851,bsc#1222979) - CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (JDK-8322122,bsc#1222983) - CVE-2024-21085: Fixed Pack200 excessive memory allocation (JDK-8322114,bsc#1222984) - CVE-2024-21094: Fixed unauthorized data modification due to C2 compilation failure with 'Exceeded _node_regs array' (JDK-8317507,JDK-8325348,bsc#1222986) Other fixes: - Update to version jdk8u412 (icedtea-3.31.0) (April 2024 CPU) * Security fixes + JDK-8318340: Improve RSA key implementations * Import of OpenJDK 8 u412 build 08 + JDK-8011180: Delete obsolete scripts + JDK-8016451: Scary messages emitted by build.tools.generatenimbus.PainterGenerator during build + JDK-8021961: setAlwaysOnTop doesn't behave correctly in Linux/Solaris under certain scenarios + JDK-8023735: [TESTBUG][macosx] runtime/XCheckJniJsig/XCheckJSig.java fails on MacOS X + JDK-8074860: Structured Exception Catcher missing around CreateJavaVM on Windows + JDK-8079441: Intermittent failures on Windows with 'Unexpected exit from test [exit code: 1080890248]' (0x406d1388) + JDK-8155590: Dubious collection management in sun.net.www.http.KeepAliveCache + JDK-8168518: rcache interop with krb5-1.15 + JDK-8183503: Update hotspot tests to allow for unique test classes directory + JDK-8186095: upgrade to jtreg 4.2 b08 + JDK-8186199: [windows] JNI_DestroyJavaVM not covered by SEH + JDK-8192931: Regression test java/awt/font/TextLayout/CombiningPerf.java fails + JDK-8208655: use JTreg skipped status in hotspot tests + JDK-8208701: Fix for JDK-8208655 causes test failures in CI tier1 + JDK-8208706: compiler/tiered/ /ConstantGettersTransitionsTest.java fails to compile + JDK-8213410: UseCompressedOops requirement check fails fails on 32-bit system + JDK-8222323: ChildAlwaysOnTopTest.java fails with 'RuntimeException: Failed to unset alwaysOnTop' + JDK-8224768: Test ActalisCA.java fails + JDK-8251155: HostIdentifier fails to canonicalize hostnames starting with digits + JDK-8251551: Use .md filename extension for README + JDK-8268678: LetsEncryptCA.java test fails as Let’s Encrypt Authority X3 is retired + JDK-8270280: security/infra/java/security/cert/ /CertPathValidator/certification/LetsEncryptCA.java OCSP response error + JDK-8270517: Add Zero support for LoongArch + JDK-8272708: [Test]: Cleanup: test/jdk/security/infra/java/ /security/cert/CertPathValidator/certification/BuypassCA.java no longer needs ocspEnabled + JDK-8276139: TestJpsHostName.java not reliable, better to expand HostIdentifierCreate.java test + JDK-8288132: Update test artifacts in QuoVadis CA interop tests + JDK-8297955: LDAP CertStore should use LdapName and not String for DNs + JDK-8301310: The SendRawSysexMessage test may cause a JVM crash + JDK-8308592: Framework for CA interoperability testing + JDK-8312126: NullPointerException in CertStore.getCRLs after 8297955 + JDK-8315042: NPE in PKCS7.parseOldSignedData + JDK-8315757: [8u] Add cacerts JTREG tests to GHA tier1 test set + JDK-8320713: Bump update version of OpenJDK: 8u412 + JDK-8321060: [8u] hotspot needs to recognise VS2022 + JDK-8321408: Add Certainly roots R1 and E1 + JDK-8322725: (tz) Update Timezone Data to 2023d + JDK-8322750: Test 'api/java_awt/interactive/ /SystemTrayTests.html' failed because A blue ball icon is added outside of the system tray + JDK-8323202: [8u] Remove get_source.sh and hgforest.sh + JDK-8323640: [TESTBUG]testMemoryFailCount in jdk/internal/ /platform/docker/TestDockerMemoryMetrics.java always fail because OOM killed + JDK-8324530: Build error with gcc 10 + JDK-8325150: (tz) Update Timezone Data to 2024a * Bug fixes + Support make 4.4 - Do not recommend timezone-java8 (bsc#1213470) - Use %patch -P N instead of deprecated %patchN. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-1450,SUSE-SLE-SERVER-12-SP5-2024-1450 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20241450-1/ Link for SUSE-SU-2024:1450-1 https://lists.suse.com/pipermail/sle-updates/2024-April/035113.html E-Mail link for SUSE-SU-2024:1450-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1213470 SUSE Bug 1213470 https://bugzilla.suse.com/1222979 SUSE Bug 1222979 https://bugzilla.suse.com/1222983 SUSE Bug 1222983 https://bugzilla.suse.com/1222984 SUSE Bug 1222984 https://bugzilla.suse.com/1222986 SUSE Bug 1222986 https://www.suse.com/security/cve/CVE-2024-21011/ SUSE CVE CVE-2024-21011 page https://www.suse.com/security/cve/CVE-2024-21068/ SUSE CVE CVE-2024-21068 page https://www.suse.com/security/cve/CVE-2024-21085/ SUSE CVE CVE-2024-21085 page https://www.suse.com/security/cve/CVE-2024-21094/ SUSE CVE CVE-2024-21094 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 java-1_8_0-openjdk-1.8.0.412-27.99.1 java-1_8_0-openjdk-accessibility-1.8.0.412-27.99.1 java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 java-1_8_0-openjdk-javadoc-1.8.0.412-27.99.1 java-1_8_0-openjdk-src-1.8.0.412-27.99.1 java-1_8_0-openjdk-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server 12 SP5 java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server 12 SP5 java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server 12 SP5 java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server 12 SP5 java-1_8_0-openjdk-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2024-21011 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241450-1/ https://www.suse.com/security/cve/CVE-2024-21011.html CVE-2024-21011 https://bugzilla.suse.com/1222979 SUSE Bug 1222979 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2024-21068 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241450-1/ https://www.suse.com/security/cve/CVE-2024-21068.html CVE-2024-21068 https://bugzilla.suse.com/1222983 SUSE Bug 1222983 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2024-21085 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241450-1/ https://www.suse.com/security/cve/CVE-2024-21085.html CVE-2024-21085 https://bugzilla.suse.com/1222984 SUSE Bug 1222984 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2024-21094 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-demo-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-devel-1.8.0.412-27.99.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-openjdk-headless-1.8.0.412-27.99.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241450-1/ https://www.suse.com/security/cve/CVE-2024-21094.html CVE-2024-21094 https://bugzilla.suse.com/1222986 SUSE Bug 1222986