java-11-openjdk-11.0.16.0.8-1.el8

エラータID: AXSA:2022-3697:10

Release date: 
Tuesday, August 16, 2022 - 05:09
Subject: 
java-11-openjdk-11.0.16.0.8-1.el8
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8).

Security Fix(es):

* OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
* OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
* OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [openjdk-11]
* Revert to disabling system security properties and FIPS mode support together [openjdk-11]
* SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [openjdk-11]

CVE-2022-21540
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2022-21541
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. java-11-openjdk-11.0.16.0.8-1.el8.src.rpm
    MD5: cb7fc9722a05384f4a2be1aa30d7b840
    SHA-256: 4e83432a1b66b5a977a7fef8c7c8e02490285c9161bfbadf5ae658034bca9169
    Size: 75.16 MB

Asianux Server 8 for x86_64
  1. java-11-openjdk-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 02760037eb467b30ce9d6fe2e51793a4
    SHA-256: d8ef44b0b25961de19ca790dde1151b95866be7c6fc90a630f624cbe79814f6b
    Size: 271.12 kB
  2. java-11-openjdk-demo-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 7871de693a09ff52e4cdf4fffa925876
    SHA-256: af75b19e270c182393b9fa74681cc9b4f01a1400531b4c17b5d8775e6e4c1980
    Size: 4.37 MB
  3. java-11-openjdk-demo-fastdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 45fa8951dcc01e4a4e8f2f74928704d6
    SHA-256: 6a3d0caec8a5bc8f577bc2efcce9b365c0292448f8267d45f5f4cccbdadc7bae
    Size: 4.38 MB
  4. java-11-openjdk-demo-slowdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 87ed07e2acd57d60dc011104a0dab29b
    SHA-256: 7935c3aba6ff6a8cc38543d4eeeb535f537c40476163b5ae4edbc0f87d7b1003
    Size: 4.38 MB
  5. java-11-openjdk-devel-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 83f5f50d43b0db8261dc23f5fccfe8d1
    SHA-256: 831493638e59a0f52b9b4d60ea4c10520ba7a6e108fc2b310980fc3a5e129536
    Size: 3.38 MB
  6. java-11-openjdk-devel-fastdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 4ee91c000551d5bb480b1dc66582d321
    SHA-256: 053cfd72ac585e4a42cb8f14b4b9d3aaf67843e87af3b1b43a183f9751aa2281
    Size: 3.39 MB
  7. java-11-openjdk-devel-slowdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: d8be5b2c8ae7bdb351184492b1b04cd4
    SHA-256: ae386dc1f7e8353b257790dd52280ce3febcd7d9045e887d7950d90f22b57e41
    Size: 3.39 MB
  8. java-11-openjdk-fastdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: ee57b50647826f7f037885b7a0261dbe
    SHA-256: 714cdd2e3de7d69b22c76e2d45057aec158c61d8c036b9d22e1feca87a5f736c
    Size: 284.60 kB
  9. java-11-openjdk-headless-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: a05f3635edeefe5a6c9e507cb0a78346
    SHA-256: 5c751dc69fac3f7438d0f94af3523896a62e5b71e4f52a375d8f91e0cc17096a
    Size: 39.64 MB
  10. java-11-openjdk-headless-fastdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 71701d8872fc13800bda042dcc4d23f5
    SHA-256: a7f13606ca8a0c97fe43455205ab46c84bcbad86d32aa4e0a95c6de3b66aa3c9
    Size: 44.62 MB
  11. java-11-openjdk-headless-slowdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: d3904f83fae106242c86b93ebc8484a2
    SHA-256: 73c695d97c9af5e26d90b636d0b4b3d2dbf851c490998887d5574e94568850eb
    Size: 43.04 MB
  12. java-11-openjdk-javadoc-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 229800f412761a9047bf1143504ca62c
    SHA-256: e7c34c002c8dc51da37a0fcb2636d46030410eb62c4bbe83e29e389e409d4d5a
    Size: 16.00 MB
  13. java-11-openjdk-javadoc-zip-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 754109628a2c84c309333a3f43d6da28
    SHA-256: c1e6bf606efd6ec7fac954400b995de9e0941f5f9467a1986c629218be0228bc
    Size: 41.99 MB
  14. java-11-openjdk-jmods-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 523b4e629d502ba78174723d0218fa5c
    SHA-256: 6f432a2e00d4d4cc9ffcdbfcadfad34b4624db9849d21aa24e080b9118936773
    Size: 318.77 MB
  15. java-11-openjdk-jmods-fastdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: fff161d8d844bd2a054541b5a0602479
    SHA-256: 640afbdaa6538636e01dd768edab8835a7e6c51c819e120209a4d3f986f9c245
    Size: 273.89 MB
  16. java-11-openjdk-jmods-slowdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 9a62c4bcdc74311bdded75740a072bc6
    SHA-256: 6c13c73aca32aee338b697dae185acce1be014f0148f18cd5df71942ffc9a1b8
    Size: 210.43 MB
  17. java-11-openjdk-slowdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: a388391c1c4f3b5b78ac84caf14678b0
    SHA-256: cb7912ae1cc51b47d532316fb9afde2331df6f8bb10ac3d266f60293218ba821
    Size: 274.21 kB
  18. java-11-openjdk-src-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: a8ea2b911ec6b6d68ac330315643de8e
    SHA-256: e497b737df007720b50e635fc484a642a2742a97b5689b230c084d9c5168d2a8
    Size: 50.43 MB
  19. java-11-openjdk-src-fastdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 47366eca3ccc8b3b37e7f9420ab6371a
    SHA-256: 919690fea894a275b448af1e9e96ba3611912dc35a56b020e4a1783486779e74
    Size: 50.43 MB
  20. java-11-openjdk-src-slowdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: dd55503bc19af1769fdf06e020b2452c
    SHA-256: 0972fe0d44da320a0eff53360424e742c70dd8b99722c28f92f4e844886a839d
    Size: 50.43 MB
  21. java-11-openjdk-static-libs-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: d410b30bfb2ecc273a2d0bbfb723e14a
    SHA-256: 4241f983998c77b3afdd6d3987ae8dda77e5d671e989017a43a0bd48d6772891
    Size: 24.00 MB
  22. java-11-openjdk-static-libs-fastdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 30f8756a401419df06179d0b76f48814
    SHA-256: df153c1457ef659adbce11cc6b34cb8d46a01fcac4919e1734965b610975a31a
    Size: 24.24 MB
  23. java-11-openjdk-static-libs-slowdebug-11.0.16.0.8-1.el8.x86_64.rpm
    MD5: 98951b88804a4426b0f819d705b5615d
    SHA-256: 0e44b913d696d564515dfd63936564ef5d15b1215c3ed7442428b57d9eed79f7
    Size: 20.72 MB