java-21-openjdk-21.0.3.0.9-1.el9.ML.1
エラータID: AXSA:2024-7714:08
リリース日:
2024/04/24 Wednesday - 15:55
題名:
java-21-openjdk-21.0.3.0.9-1.el9.ML.1
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- Java の Hotspot コンポーネントには、リモートの攻撃者により、
複数のプロトコルによるネットワークアクセスを介して、部分的
なサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2024-21011)
- Java の Networking コンポーネントには、リモートの攻撃者
により、複数のプロトコルによるネットワークアクセスを介して、
不正なデータの操作 (更新、挿入、および削除) を可能とする
脆弱性が存在します。(CVE-2024-21012)
- Java の Hotspot コンポーネントには、リモートの攻撃者により、
複数のプロトコルによるネットワークアクセスを介して、不正な
データの操作 (更新、挿入、および削除) を可能とする脆弱性が
存在します。(CVE-2024-21068)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2024-21011
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2024-21012
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2024-21068
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
追加情報:
N/A
ダウンロード:
SRPMS
- java-21-openjdk-21.0.3.0.9-1.el9.ML.1.src.rpm
MD5: 8e011c48969f3bcb701b127737217772
SHA-256: 0619b4390feafd6dd312846f089ad6f7d0fc844605f2490f4ffc4b0cc887a54e
Size: 66.52 MB
Asianux Server 9 for x86_64
- java-21-openjdk-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 9eb1374364ec6ad223b4ede3f86a8574
SHA-256: dd15bb393c1f5ed44cbf22b4be8d7aaecc712d7e0d1ca664247dade250d7f47d
Size: 451.32 kB - java-21-openjdk-demo-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: c26149d3ddc529a3a0ca2c2b8d5296b3
SHA-256: bcecb909e239976f7c7aa4475a53337619d2560a84959677f5657843e06161ff
Size: 3.17 MB - java-21-openjdk-demo-fastdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: cdb6b127ee21e78ab9b97ba65c866536
SHA-256: 22a8f01cf86f7b590c4758ef182165d8c07c86ceaa679b48330ed5f5f63610d9
Size: 3.17 MB - java-21-openjdk-demo-slowdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 5824bffd5776e9f9a02493151bcbea12
SHA-256: fb07636d15ce77ab69660de7e5af9c357b14c533e7285f8567d87570dfc6dd03
Size: 3.17 MB - java-21-openjdk-devel-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: e77a7080b5eb3d03c67da804c3936c60
SHA-256: 6561fc1e8ea7fc89abd4f1d0fec492f49b149758b55a95b825be9f18f7bf8493
Size: 5.00 MB - java-21-openjdk-devel-fastdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: fadcc6ac681c2ab54e616ad4f08993da
SHA-256: 7523b13b56a37b222b5d11e6fd4648fa48e53a15dbc0c1736579eb57b7a1beb9
Size: 5.00 MB - java-21-openjdk-devel-slowdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 70acf2e675bfe24bfe16a10856f95936
SHA-256: 973bc8c792bf3430080542445f3fd8a884548f7e9edda646393ef64bb4f14015
Size: 5.00 MB - java-21-openjdk-fastdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: ee2e0b0f026eb05cc8cbadf3a0460c66
SHA-256: a409fe58cc37758e24813deeeb3b217ff395deac1ba931cd9c17cdc3b59d57c2
Size: 459.44 kB - java-21-openjdk-headless-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 2cdce99da875d4fda04d9645e2990fce
SHA-256: 39f18dcfca10d3d8ddbfeacd7b778166dfb826bfc89370f372123a8cf4d66202
Size: 48.52 MB - java-21-openjdk-headless-fastdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 90200f3700c3b31d9109de44f1af864b
SHA-256: ea58b422e4ee5c4db0197da52b65fe85b4a899393756022eacc0a1574343109a
Size: 53.19 MB - java-21-openjdk-headless-slowdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: b603577c5a3eba8a09f64aad24435b49
SHA-256: 791720e6140ffdd6377d6069efecb745551fc324ca86fb17f7bf4210d1d565f2
Size: 53.28 MB - java-21-openjdk-javadoc-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 78b5789ab854e25db185e37f04449838
SHA-256: 4a3abb944ecb2aed5491909059a33473a08cfb0349a1b1b20a849373f72d6bc3
Size: 15.02 MB - java-21-openjdk-javadoc-zip-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: bb7255a8d68bd0a0f180cb988ed750e5
SHA-256: f90d20eee49d1cfc01769a6a91b0e60c5757ff733caa406c158b5c7e5dba5fd4
Size: 40.65 MB - java-21-openjdk-jmods-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: e2c6b65205607625b3ca4ce16cc97535
SHA-256: 0df143748686787b398e67af6999b2cc66fd30036129408cff788911baaa16c0
Size: 308.73 MB - java-21-openjdk-jmods-fastdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 56f79ea6fca840fa0221f8ecb023e195
SHA-256: 311bd227487b5400c1bdf56f89455e270c335d98b1d093690aa9850ab9bc7374
Size: 362.32 MB - java-21-openjdk-jmods-slowdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: f1aa8b453e49595f76471c50c7199b93
SHA-256: 5228f37a82a831ca14b2a703c5c2f3e152f1877b7c27a69efb660f2218e16254
Size: 279.36 MB - java-21-openjdk-slowdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: eb2caf1f9c5d57c2ee5d6e2d7959400d
SHA-256: b8b19ecdb653ee20c7fc0736a7d8eca962ff1caca67b299d0f32a2665c675d1d
Size: 433.66 kB - java-21-openjdk-src-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 9fbdcda566476d0ca66ffc03e717ce2e
SHA-256: e043913d5d05b6d80d3881794d204c1d719b4fae529e9a30c6d284e51aa7dfac
Size: 46.67 MB - java-21-openjdk-src-fastdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 44564b011bd8893f6c7b41f89f401688
SHA-256: 086cfa1a0245d555e1af19e96ff982433ee54211f1851de3bf7748df72a52cdf
Size: 46.67 MB - java-21-openjdk-src-slowdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 4f3fcbb7ea7fa1186e3c40030c7c989f
SHA-256: 76262b89f4d4b06c423375fd05d5da7b18c16296794cb20f286509fdb56d3c75
Size: 46.67 MB - java-21-openjdk-static-libs-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: a72edea804574a079952cc2420fdb23f
SHA-256: ab4c529e9aed360530488d76827ac8a50f311791159b8e21aac4f422afbb3bff
Size: 38.14 MB - java-21-openjdk-static-libs-fastdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 8cdbd8fa85d4791a7178b3f8915fc513
SHA-256: 3e3fcc7501a231254d4a693eb2de00619cc4c3835cb37323ed9fc087d4cc79aa
Size: 38.41 MB - java-21-openjdk-static-libs-slowdebug-21.0.3.0.9-1.el9.ML.1.x86_64.rpm
MD5: 7a556803629aa8a963aa07be3908538d
SHA-256: 656ea86f52c6c67a6576f25d3fec85da1879dfd6fa46723b5524e103af9465df
Size: 31.52 MB