REDHAT-BUG-2257720: High severity openjdk 8 vulnerability

Published Jan 10, 2024

Updated

It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain a file and directory entry with the same name within the ZIP file. This could lead to integrity issues when extracting data from such archives. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Jan 10, 2024

Data Sourced

via Red Hat·03:43 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2257720?

The severity of REDHAT-BUG-2257720 is classified as high due to potential integrity issues when handling ZIP archives.

How do I fix REDHAT-BUG-2257720?

To fix REDHAT-BUG-2257720, update your OpenJDK installation to the latest version provided by your vendor.

What types of applications are affected by REDHAT-BUG-2257720?

REDHAT-BUG-2257720 affects untrusted Java applications or applets that process ZIP archives.

What causes the vulnerability in REDHAT-BUG-2257720?

The vulnerability in REDHAT-BUG-2257720 is caused by the improper handling of ZIP archives containing files and directories with the same name.

Is there a workaround for REDHAT-BUG-2257720?

A temporary workaround for REDHAT-BUG-2257720 is to avoid using untrusted ZIP archives that might exploit this issue.