USN-6661-1: OpenJDK 17 vulnerabilities

Published Feb 27, 2024
·
Updated

Yi Yang discovered that the Hotspot component of OpenJDK 17 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20918) It was discovered that the Hotspot component of OpenJDK 17 did not properly verify bytecode in certain situations. An attacker could possibly use this issue to bypass Java sandbox restrictions. (CVE-2024-20919) It was discovered that the Hotspot component of OpenJDK 17 had an optimization flaw when generating range check loop predicates. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921) Yakov Shafranovich discovered that OpenJDK 17 incorrectly handled ZIP archives that have file and directory entries with the same name. An attacker could possibly use this issue to bypass Java sandbox restrictions. (CVE-2024-20932) It was discovered that OpenJDK 17 could produce debug logs that contained private keys used for digital signatures. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-20945) Hubert Kario discovered that the TLS implementation in OpenJDK 17 had a timing side-channel and incorrectly handled RSA padding. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2024-20952)

Affected Software

40 affected componentsFixes available
All of the following
ubuntu/openjdk-17-jdk<17.0.10+7-1~23.10.1
17.0.10+7-1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/openjdk-17-jdk-headless<17.0.10+7-1~23.10.1
17.0.10+7-1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/openjdk-17-jre<17.0.10+7-1~23.10.1
17.0.10+7-1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/openjdk-17-jre-headless<17.0.10+7-1~23.10.1
17.0.10+7-1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/openjdk-17-jre-zero<17.0.10+7-1~23.10.1
17.0.10+7-1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/openjdk-17-jdk<17.0.10+7-1~22.04.1
17.0.10+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-17-jdk-headless<17.0.10+7-1~22.04.1
17.0.10+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-17-jre<17.0.10+7-1~22.04.1
17.0.10+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-17-jre-headless<17.0.10+7-1~22.04.1
17.0.10+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-17-jre-zero<17.0.10+7-1~22.04.1
17.0.10+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-17-jdk<17.0.10+7-1~20.04.1
17.0.10+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-17-jdk-headless<17.0.10+7-1~20.04.1
17.0.10+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-17-jre<17.0.10+7-1~20.04.1
17.0.10+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-17-jre-headless<17.0.10+7-1~20.04.1
17.0.10+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-17-jre-zero<17.0.10+7-1~20.04.1
17.0.10+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-17-jdk<17.0.10+7-1~18.04.1
17.0.10+7-1~18.04.1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/openjdk-17-jdk-headless<17.0.10+7-1~18.04.1
17.0.10+7-1~18.04.1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/openjdk-17-jre<17.0.10+7-1~18.04.1
17.0.10+7-1~18.04.1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/openjdk-17-jre-headless<17.0.10+7-1~18.04.1
17.0.10+7-1~18.04.1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/openjdk-17-jre-zero<17.0.10+7-1~18.04.1
17.0.10+7-1~18.04.1
Ubuntu Ubuntu=18.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/openjdk-17-jdk to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~23.10.1
  2. Upgrade

    Upgrade ubuntu/openjdk-17-jdk-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~23.10.1
  3. Upgrade

    Upgrade ubuntu/openjdk-17-jre to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~23.10.1
  4. Upgrade

    Upgrade ubuntu/openjdk-17-jre-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~23.10.1
  5. Upgrade

    Upgrade ubuntu/openjdk-17-jre-zero to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~23.10.1
  6. Upgrade

    Upgrade ubuntu/openjdk-17-jdk to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~22.04.1
  7. Upgrade

    Upgrade ubuntu/openjdk-17-jdk-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~22.04.1
  8. Upgrade

    Upgrade ubuntu/openjdk-17-jre to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~22.04.1
  9. Upgrade

    Upgrade ubuntu/openjdk-17-jre-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~22.04.1
  10. Upgrade

    Upgrade ubuntu/openjdk-17-jre-zero to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~22.04.1
  11. Upgrade

    Upgrade ubuntu/openjdk-17-jdk to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~20.04.1
  12. Upgrade

    Upgrade ubuntu/openjdk-17-jdk-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~20.04.1
  13. Upgrade

    Upgrade ubuntu/openjdk-17-jre to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~20.04.1
  14. Upgrade

    Upgrade ubuntu/openjdk-17-jre-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~20.04.1
  15. Upgrade

    Upgrade ubuntu/openjdk-17-jre-zero to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~20.04.1
  16. Upgrade

    Upgrade ubuntu/openjdk-17-jdk to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~18.04.1
  17. Upgrade

    Upgrade ubuntu/openjdk-17-jdk-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~18.04.1
  18. Upgrade

    Upgrade ubuntu/openjdk-17-jre to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~18.04.1
  19. Upgrade

    Upgrade ubuntu/openjdk-17-jre-headless to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~18.04.1
  20. Upgrade

    Upgrade ubuntu/openjdk-17-jre-zero to a version that resolves this vulnerability.

    Fixed in 17.0.10+7-1~18.04.1

Event History

Feb 27, 2024
Advisory Published
via Ubuntu·12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of USN-6661-1?

The severity of USN-6661-1 is classified as critical due to its potential to cause denial of service or execute arbitrary code.

2

How do I fix USN-6661-1?

To fix USN-6661-1, upgrade affected packages to the versions 17.0.10+7-1~23.10.1 or 17.0.10+7-1~22.04.1, depending on your Ubuntu version.

3

Which versions of OpenJDK are affected by USN-6661-1?

USN-6661-1 affects OpenJDK versions prior to 17.0.10+7-1~23.10.1 for Ubuntu 23.10, as well as earlier versions for Ubuntu 22.04 and 20.04.

4

Can USN-6661-1 be exploited remotely?

Yes, USN-6661-1 can potentially be exploited remotely by an attacker to cause denial of service or to bypass Java security restrictions.

5

What should I do if I'm running a version affected by USN-6661-1?

If running a version affected by USN-6661-1, you should prioritize upgrading to the patched versions provided in the advisory.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203