SUSE-SU-2024:0325-1: Security update for java-17-openjdk

Q: Which deployments are covered by this update?

The update applies to java-17-openjdk on openSUSE Leap 15.4 and 15.5, SUSE Basesystem Module 15-SP5, and specified SUSE Linux Enterprise High Performance Computing 15 SP4 variants. Listed architectures include aarch64, ppc64le, s390x, x86_64, and, for some Leap 15.4 packages, i586.

Q: What types of security impact are addressed?

The update fixes Hotspot JVM out-of-bounds access, a class-file-verifier sandbox bypass, and an optimization issue that can corrupt JVM memory. It also addresses duplicate ZIP entry handling, potential private-key exposure through debug logs, and an RSA padding and TLS timing side-channel issue.

Q: What version contains the fixes?

The package is updated to OpenJDK version 17.0.10, incorporating the January 2024 CPU fixes.

Published Feb 5, 2024

Updated

This update for java-17-openjdk fixes the following issues: Updated to version 17.0.10 (January 2024 CPU): CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907). CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903). CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905). CVE-2024-20932: Fixed an incorrect handling of ZIP files with duplicate entries (bsc#1218908). CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909). CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911). Find the full release notes at: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029089.html

Affected Software

107 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)

Any of the following

suse/java<17-openjdk-src-17.0.10.0-150400.3.36.1

17-openjdk-src-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-jmods-17.0.10.0-150400.3.36.1

17-openjdk-jmods-17.0.10.0-150400.3.36.1

All of the following

SUSE openSUSE Leap 15.4 (noarch)

suse/java<17-openjdk-javadoc-17.0.10.0-150400.3.36.1

17-openjdk-javadoc-17.0.10.0-150400.3.36.1

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/java<17-openjdk-src-17.0.10.0-150400.3.36.1

17-openjdk-src-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-jmods-17.0.10.0-150400.3.36.1

17-openjdk-jmods-17.0.10.0-150400.3.36.1

All of the following

SUSE openSUSE Leap 15.5 (noarch)

suse/java<17-openjdk-javadoc-17.0.10.0-150400.3.36.1

17-openjdk-javadoc-17.0.10.0-150400.3.36.1

All of the following

SUSE Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Manager Proxy 4.3 (x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Manager Retail Branch Server 4.3 (x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

All of the following

SUSE SUSE Manager Server 4.3 (ppc64le s390x x86_64)

Any of the following

suse/java<17-openjdk-debugsource-17.0.10.0-150400.3.36.1

17-openjdk-debugsource-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-17.0.10.0-150400.3.36.1

17-openjdk-headless-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-demo-17.0.10.0-150400.3.36.1

17-openjdk-demo-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-17.0.10.0-150400.3.36.1

17-openjdk-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-17.0.10.0-150400.3.36.1

17-openjdk-devel-17.0.10.0-150400.3.36.1

suse/java<17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-src-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-debugsource-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-debuginfo-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-headless-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-demo-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-devel-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-jmods-17.0.10.0-150400.3.36.1
Upgrade
Upgrade suse/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-javadoc-17.0.10.0-150400.3.36.1
Upgrade
Upgrade java-17-openjdk to a version that resolves this vulnerability.
Fixed in 17.0.10

Event History

Feb 5, 2024

Advisory Published

via SUSE·12:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are covered by this update?

The update applies to java-17-openjdk on openSUSE Leap 15.4 and 15.5, SUSE Basesystem Module 15-SP5, and specified SUSE Linux Enterprise High Performance Computing 15 SP4 variants. Listed architectures include aarch64, ppc64le, s390x, x86_64, and, for some Leap 15.4 packages, i586.

What types of security impact are addressed?

The update fixes Hotspot JVM out-of-bounds access, a class-file-verifier sandbox bypass, and an optimization issue that can corrupt JVM memory. It also addresses duplicate ZIP entry handling, potential private-key exposure through debug logs, and an RSA padding and TLS timing side-channel issue.

What version contains the fixes?

The package is updated to OpenJDK version 17.0.10, incorporating the January 2024 CPU fixes.

SUSE-SU-2024:0325-1: Security update for java-17-openjdk

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are covered by this update?

What types of security impact are addressed?

What version contains the fixes?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are covered by this update?

What types of security impact are addressed?

What version contains the fixes?