REDHAT-BUG-1982879
First published: Thu Jul 15 2021(Updated: )
A flaw was found in the way the Library component of OpenJDK handled JAR files containing multiple MANIFEST.MF files. Such JAR files could cause signature verification process to return an incorrect result, possibly allowing tampering with signed JAR files. After the fix, all JAR files with multiple MANIFEST.MF files are treated as unsigned.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.oracle.com/security-alerts/cpujul2021.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2021:2783
- https://access.redhat.com/errata/RHSA-2021:2782
- https://access.redhat.com/errata/RHSA-2021:2781
- https://access.redhat.com/errata/RHSA-2021:2784
- https://access.redhat.com/errata/RHSA-2021:2776
- https://access.redhat.com/security/cve/cve-2021-2369
- https://access.redhat.com/errata/RHSA-2021:2775
- https://access.redhat.com/errata/RHSA-2021:2774
- https://access.redhat.com/errata/RHSA-2021:2845
- https://access.redhat.com/errata/RHSA-2021:2778
- https://access.redhat.com/errata/RHSA-2021:2777
- https://access.redhat.com/errata/RHSA-2021:2780
- https://access.redhat.com/errata/RHSA-2021:2779
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/e23ebe923867
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/465a2d03f9b0
- https://access.redhat.com/errata/RHSA-2021:3292
- https://access.redhat.com/errata/RHSA-2021:3293
- https://access.redhat.com/errata/RHSA-2021:4089
- https://bugzilla.redhat.com/show_bug.cgi?id=1982879
Frequently Asked Questions
What is the severity of REDHAT-BUG-1982879?
The severity of REDHAT-BUG-1982879 is classified as high due to the potential for tampering with signed JAR files.
How do I fix REDHAT-BUG-1982879?
To fix REDHAT-BUG-1982879, you should update to the latest version of OpenJDK where the flaw has been addressed.
What systems are affected by REDHAT-BUG-1982879?
REDHAT-BUG-1982879 affects systems running OpenJDK that utilize JAR files with multiple MANIFEST.MF files.
What impact does REDHAT-BUG-1982879 have on application security?
REDHAT-BUG-1982879 could potentially allow malicious actors to tamper with the contents of signed JAR files, undermining application integrity.
Is there a workaround for REDHAT-BUG-1982879?
There is no known workaround for REDHAT-BUG-1982879, so it is recommended to apply the available updates as soon as possible.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-2369
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openjdk
- canonical/openjdk