RHSA-2023:4177: Moderate: java-17-openjdk security and bug fix update
Moderate: java-17-openjdk security and bug fix update
Other sources
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.Security Fix(es): OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044) OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221653) Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [rhel-9] (BZ#2222852)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debugsource-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-zip-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-debugsource-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-javadoc-zip-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-fastdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-slowdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-fastdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-fastdebug-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-fastdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-fastdebug-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-fastdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-fastdebug-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-fastdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-slowdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-debuginfo-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-fastdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-slowdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-fastdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-slowdebug-17.0.8.0.7-2.el9 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-fastdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-demo-slowdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-fastdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-fastdebug-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-devel-slowdebug-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-fastdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-fastdebug-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-fastdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-fastdebug-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-headless-slowdebug-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-fastdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-jmods-slowdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-slowdebug-debuginfo-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-fastdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-src-slowdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-fastdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 17-openjdk-static-libs-slowdebug-17.0.8.0.7-2.el9.aa - Upgrade
Upgrade
java-17-openjdkto a version that resolves this vulnerability.Fixed in 17.0.8 - Operational
Restart all running instances of OpenJDK Java for the update to take effect.
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:4177?
The severity of RHSA-2023:4177 is classified as moderate.
How do I fix RHSA-2023:4177?
To fix RHSA-2023:4177, install the updated package version 17-openjdk-17.0.8.0.7-2.el9.
Which systems are affected by RHSA-2023:4177?
RHSA-2023:4177 affects various Red Hat CodeReady Linux Builder products for ARM 64 and Power architectures.
What vulnerabilities are addressed by RHSA-2023:4177?
RHSA-2023:4177 addresses security vulnerabilities and bugs associated with the java-17-openjdk package.
Is RHSA-2023:4177 applicable to my system?
To determine applicability, verify if you are using the vulnerable java packages specified in RHSA-2023:4177.