REDHAT-BUG-2041897: Medium severity openjdk 8 vulnerability

Published Jan 18, 2022

Updated

It was discovered that the ObjectInputStream class implementation in the Serialization component of OpenJDK did not sufficiently validate data read from the input serialized stream when reading serialized exceptions. A specially-crafted serialized stream could use this flaw to bypass certain deserialization restrictions (defined via jdk.serialFilter system or security property).

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Jan 18, 2022

Data Sourced

via Red Hat·01:37 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2041897?

The severity of REDHAT-BUG-2041897 is classified as high, indicating a significant risk to systems using the affected OpenJDK implementation.

How do I fix REDHAT-BUG-2041897?

To fix REDHAT-BUG-2041897, you should apply the latest security updates or patches provided for the affected OpenJDK versions.

What are the risks associated with REDHAT-BUG-2041897?

The risks associated with REDHAT-BUG-2041897 include the potential for unauthorized access to sensitive data and possible remote code execution through specially-crafted serialized streams.

Which versions of OpenJDK are affected by REDHAT-BUG-2041897?

REDHAT-BUG-2041897 affects Oracle OpenJDK 17 and may impact other versions that utilize the vulnerable ObjectInputStream implementation.

When was REDHAT-BUG-2041897 disclosed?

REDHAT-BUG-2041897 was disclosed in January 2022 as part of a broader set of security vulnerabilities affecting OpenJDK.