USN-6662-1: OpenJDK 21 vulnerabilities
Yi Yang discovered that the Hotspot component of OpenJDK 21 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20918) It was discovered that the Hotspot component of OpenJDK 21 did not properly verify bytecode in certain situations. An attacker could possibly use this issue to bypass Java sandbox restrictions. (CVE-2024-20919) It was discovered that the Hotspot component of OpenJDK 21 had an optimization flaw when generating range check loop predicates. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921) It was discovered that OpenJDK 21 could produce debug logs that contained private keys used for digital signatures. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-20945) Hubert Kario discovered that the TLS implementation in OpenJDK 21 had a timing side-channel and incorrectly handled RSA padding. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2024-20952)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openjdk-21-jdkto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~23.10.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jdk-headlessto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~23.10.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jreto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~23.10.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-headlessto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~23.10.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-zeroto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~23.10.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jdkto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jdk-headlessto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jreto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-headlessto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-zeroto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jdkto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jdk-headlessto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jreto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-headlessto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-zeroto a version that resolves this vulnerability.Fixed in 21.0.2+13-1~20.04.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6662-1?
The severity of USN-6662-1 is classified as high due to the potential for denial of service, arbitrary code execution, and Java sandbox bypass.
How do I fix USN-6662-1?
To fix USN-6662-1, you should upgrade to OpenJDK version 21.0.2+13-1~23.10.1 or later on your Ubuntu system.
Which packages are affected by USN-6662-1?
The affected packages for USN-6662-1 include openjdk-21-jdk, openjdk-21-jdk-headless, openjdk-21-jre, and others across Ubuntu 20.04, 22.04, and 23.10.
How can USN-6662-1 impact system security?
USN-6662-1 can impact system security by allowing attackers to execute arbitrary code and potentially bypass Java security restrictions.
Is a system reboot required after applying the fix for USN-6662-1?
A system reboot is not necessarily required to apply the fix for USN-6662-1, but it is recommended to ensure all updates take effect.