java-1.8.0-openjdk-1.8.0.342.b07-1.el9
エラータID: AXSA:2022-4038:13
リリース日:
2022/11/15 Tuesday - 08:27
題名:
java-1.8.0-openjdk-1.8.0.342.b07-1.el9
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- java の Hotspot コンポーネントには、クライアント上で信頼されて
いないコードを実行した場合に、認証されていない攻撃者によって、
データの不正な読み取りが可能になる脆弱性があります。
(CVE-2022-21540)
- java の Hotspot コンポーネントには、クライアント上で信頼されて
いないコードを実行した場合に、認証されていない攻撃者によって、
java がアクセス可能なすべてのデータに対し、不正なアクセスや操作
が可能性になる脆弱性があります。(CVE-2022-21541)
- java の Apache Xalan Java XSLT ライブラリには、整数トランケー
ションの問題があるため、悪意のある XSLT スタイルシートを処理する
際に、任意の java バイトコード実行が可能になる脆弱性があります。
(CVE-2022-34169)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2022-21540
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2022-21541
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
追加情報:
N/A
ダウンロード:
SRPMS
- java-1.8.0-openjdk-1.8.0.342.b07-1.el9.src.rpm
MD5: 6808801c1177971eb383cf26876b67b4
SHA-256: db3d5bb49ec2ccf061f170126424470806eb242eb7b00b6c195400966353bbd3
Size: 55.67 MB
Asianux Server 9 for x86_64
- java-1.8.0-openjdk-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: f18848e84ee7f3d7085616beaae8e282
SHA-256: abcf6c4e57bb43b4408a9926d74cf924fd6f2de436ce095245292da036b02f3e
Size: 267.12 kB - java-1.8.0-openjdk-demo-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 67fea2cd40c9c50e5f33dada683665b9
SHA-256: 8c53dd8ca7abc934cd58f599543dfc706e0b9e83e4adc7909f820d8e8428fd50
Size: 1.92 MB - java-1.8.0-openjdk-demo-fastdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 4aa545ee5d02ff27f1bba0326489103f
SHA-256: 923ae8c50f0a1364e12cad513c3676d7e787eacfb89dfd5f4b24c9447daa8dc6
Size: 1.94 MB - java-1.8.0-openjdk-demo-slowdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 1ffbdd23bc203daa150b4fb731e9b541
SHA-256: 9b40bf84a06a9e379a02c7f525d8c4a1b61166f59058e4780dd2a1c19ee09917
Size: 1.93 MB - java-1.8.0-openjdk-devel-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 24f26b60debc25c799af4e9435aaf031
SHA-256: 6886b7207ab1250bd3cc3d066a9f709b74f6cf2ecae7fa4d8c62acf99a006300
Size: 9.28 MB - java-1.8.0-openjdk-devel-fastdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 9f8cfa1e2819929a4e5fd22e1847a449
SHA-256: c65a0fb3b7a839cb60045cbee327f77aaf8a840cad989fc1339280a3ac918b51
Size: 9.29 MB - java-1.8.0-openjdk-devel-slowdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: d02e6a0f9abdfd80eddb4626374a8da7
SHA-256: 10a597b0fb6773d66311afedb2e4ba2f20f5d42a4628af1e905495edd6afeb3c
Size: 9.30 MB - java-1.8.0-openjdk-fastdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: d2b4240ac4ee522e62f534ec1d933493
SHA-256: 53c48a7f221b5c8c7b6f6861a6c03dabe335f37b3b8a793ab34117b13825fc61
Size: 280.48 kB - java-1.8.0-openjdk-headless-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: c85983d6991df855c22078c69e974df2
SHA-256: 891bfd88c1ed08b7e3df60e717a85c1e63503b32ffb90994b945cc76c2b9fd99
Size: 32.83 MB - java-1.8.0-openjdk-headless-fastdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 24ed33020b70545dfd83afb405d08a94
SHA-256: 233d4f05ca5ba2aa9da61bba172619ec30e6d6f87d2da29dca20edad4c7f8e45
Size: 36.64 MB - java-1.8.0-openjdk-headless-slowdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 3e713fac46f12be23d9602f3bebe2d73
SHA-256: b60018405b9fead7f52416259869078ba6dd446b3f4fbcde336b6deecde2b429
Size: 34.55 MB - java-1.8.0-openjdk-javadoc-1.8.0.342.b07-1.el9.noarch.rpm
MD5: 390fc0a560eaf9bd7f56a4182eb96117
SHA-256: 4bf65cd9c556a5fdaa519b5b8f3f45fc5c36e941e2e16545bd2d8ccd6f18c3ad
Size: 11.86 MB - java-1.8.0-openjdk-javadoc-zip-1.8.0.342.b07-1.el9.noarch.rpm
MD5: a160c51954873fb3e87563ba853734a0
SHA-256: ac34a2ba62d1fab74c950b66711f5c93d5e0b2a17bd10b95b44293c134e1c8e5
Size: 40.77 MB - java-1.8.0-openjdk-slowdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: b3aa74af1251f0e499d99e99af2ac44d
SHA-256: 16fc8732300ce69afcbfd0c8367518c9f24936eb0fee2534647dc8a53dc4b2d1
Size: 271.61 kB - java-1.8.0-openjdk-src-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 1b4ea85a8cf9a6a6e20b022149d374c6
SHA-256: 839634089184d4b512af527c809865a528f64be2164c8f22194736a552d829ae
Size: 44.61 MB - java-1.8.0-openjdk-src-fastdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: 999b13c21f76afe2af8d6a8c72dbdcc7
SHA-256: 1d10072c3f05fc8b6b84b10a483d0c7e0b16a4c6da80e8640d092b375d030ef6
Size: 44.61 MB - java-1.8.0-openjdk-src-slowdebug-1.8.0.342.b07-1.el9.x86_64.rpm
MD5: c4b8acb58b42b84fc614d21862a7b6df
SHA-256: a7e867fba4d480a2a0adca258198f408803fe1c2a01efdf6692a448ef0acdd4c
Size: 44.61 MB
English