REDHAT-BUG-2257720
First published: Wed Jan 10 2024(Updated: )
It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain a file and directory entry with the same name within the ZIP file. This could lead to integrity issues when extracting data from such archives. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK 17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:0241
- https://access.redhat.com/errata/RHSA-2024:0246
- https://access.redhat.com/errata/RHSA-2024:0240
- https://access.redhat.com/errata/RHSA-2024:0267
- https://access.redhat.com/errata/RHSA-2024:0242
- https://access.redhat.com/errata/RHSA-2024:0244
- https://github.com/openjdk/jdk17u/commit/f6f32bf256e34447f54be823fdfb2e64e235e404
- https://www.oracle.com/security-alerts/cpujan2024.html#AppendixJAVA
- https://www.oracle.com/java/technologies/javase/17-0-10-relnotes.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2257720
Frequently Asked Questions
What is the severity of REDHAT-BUG-2257720?
The severity of REDHAT-BUG-2257720 is classified as high due to potential integrity issues when handling ZIP archives.
How do I fix REDHAT-BUG-2257720?
To fix REDHAT-BUG-2257720, update your OpenJDK installation to the latest version provided by your vendor.
What types of applications are affected by REDHAT-BUG-2257720?
REDHAT-BUG-2257720 affects untrusted Java applications or applets that process ZIP archives.
What causes the vulnerability in REDHAT-BUG-2257720?
The vulnerability in REDHAT-BUG-2257720 is caused by the improper handling of ZIP archives containing files and directories with the same name.
Is there a workaround for REDHAT-BUG-2257720?
A temporary workaround for REDHAT-BUG-2257720 is to avoid using untrusted ZIP archives that might exploit this issue.
- agent/severity
- agent/type
- agent/first-publish-date
- agent/event
- agent/description
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-20932
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/openjdk 17