RHSA-2023:0191: Moderate: java-17-openjdk security and bug fix update
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.Security Fix(es): OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS database. This update allows more control over database use using two new properties - fips.nssdb.path and fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via command-line arguments to the Java virtual machine (BZ#2147475) With previous Red Hat builds of OpenJDK 17, Mac key generation and import would fail due to the lack of the CKASIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration. (BZ#2108191) NSS has offered a SQLite SecMod database for some time, and this has been available in RHEL as far back as RHEL 6. With newer NSS versions removing the Berkeley DB one, this update switches the FIPS support backed by NSS to use the SQLite backend (BZ#2023536) [rpminspect] Disable Java bytecode checks [java-17-openjdk, rhel-8] (BZ#2109107) Use the NSS SQL Database in FIPS Mode [rhel-8, openjdk-17] (BZ#2147479)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debugsource-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-zip-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debuginfo-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debugsource-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-debuginfo-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-debuginfo-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-zip-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-fastdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-slowdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-fastdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-fastdebug-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-fastdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-fastdebug-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-fastdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-fastdebug-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-fastdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-slowdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-debuginfo-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-fastdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-slowdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-fastdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-slowdebug-17.0.6.0.10-2.el8_4 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-slowdebug-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-debuginfo-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-debuginfo-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-slowdebug-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-debuginfo-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-slowdebug-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-slowdebug-17.0.6.0.10-2.el8_4.aa - Upgrade
Upgrade
java-17-openjdkto a version that resolves this vulnerability.Patch BZ#2109107 - Upgrade
Upgrade
java-17-openjdkto a version that resolves this vulnerability.Patch BZ#2147479 - Configuration
When running in FIPS mode, configure fips.nssdb.path in the java.security file permanently or pass it as a command-line argument to the JVM to control which NSS SQL database is used (BZ#2147475; update for [rhel-8, openjdk-17]).
OpenJDK 17 (FIPS mode via NSS) fips.nssdb.path = (configure to the desired NSS SQLite SecMod database path) - Configuration
When running in FIPS mode, configure fips.nssdb.pin in the java.security file permanently or pass it as a command-line argument to the JVM to control the PIN used for the NSS database (BZ#2147475; update for [rhel-8, openjdk-17]).
OpenJDK 17 (FIPS mode via NSS) fips.nssdb.pin = (configure the expected NSS database PIN) - Operational
Restart all running OpenJDK Java instances for the java-17-openjdk update (including the advisory-described changes) to take effect.
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:0191?
The severity of RHSA-2023:0191 is considered to be moderate due to the potential risk of a denial-of-service attack.
How do I fix RHSA-2023:0191?
To fix RHSA-2023:0191, update your system to the latest version of the affected OpenJDK packages provided by Red Hat.
What specific vulnerabilities does RHSA-2023:0191 address?
RHSA-2023:0191 addresses a handshake denial-of-service attack against DTLS connections and issues related to untrusted soundbank URLs.
Which versions of OpenJDK are affected by RHSA-2023:0191?
RHSA-2023:0191 affects the OpenJDK versions prior to 17-openjdk-17.0.6.0.10-2.el8_4.
Are there any recommended practices post-update for RHSA-2023:0191?
Post-update, it is recommended to monitor application performance and security logs to ensure that the vulnerabilities have been effectively mitigated.